Gnosis Pay has confirmed a security breach that exposed sensitive customer information, including full payment card numbers, security codes, residential addresses and cryptocurrency wallet details, raising concerns about identity theft and targeted attacks against crypto holders.

The company detected unauthorized access to its legacy consumer card infrastructure on November 3 and disclosed the incident on November 6 in an official blog post. Its security team began containment within two hours, subsequently replacing compromised credentials and addressing the vulnerability.

Gnosis Pay said customer funds remained unaffected and that its enterprise infrastructure, which powers white-label card programs for other companies, was not compromised. The number of affected customers and the method used to access their information have not been disclosed.

Card Numbers, Home Addresses and Wallet Details Exposed

Customer breach notifications identified a broad range of compromised information, including full names, email addresses, phone numbers, nationalities, residential addresses and cryptocurrency wallet addresses linked to Gnosis Pay accounts. More concerningly, the exposed records included full payment card numbers, expiration dates and CVV security codes. A card number, expiry date and CVV are together typically all that is required to complete an online card payment, making that combination among the most directly usable data in the exposure. Some customers also had banking information compromised, including IBAN and BIC details.

Identity documents and dates of birth were not identified among the exposed information.

Rotki founder Lefteris Karapetsas was among those publicly questioning the company's handling of sensitive customer records. Karapetsas revealed that his home address, full name, payment card number and linked wallet addresses had been exposed, expressing frustration that the company had failed to protect his information.

"Extremely disappointed. You had already lost me as a user but you could have at least protected my data," he wrote on X.

The combination of physical addresses and blockchain wallet identifiers presents particular privacy risks. Attackers could potentially associate identifiable individuals with their cryptocurrency holdings, facilitating targeted phishing, impersonation or physical threats. Unlike stolen card credentials, which can be cancelled and replaced, exposed residential information and historical blockchain addresses cannot be easily changed or erased.

Gnosis Pay Cancels Cards and Introduces Mandatory 3D Secure

Gnosis Pay has cancelled compromised cards and introduced mandatory 3D Secure authentication for online payments, adding another verification requirement before transactions can be completed. The company has also increased monitoring of card activity and connected wallets, notified affected customers individually, and reported the breach to its card issuer, business partners and relevant data protection authorities. Additional monitoring is being arranged to detect potential misuse of the compromised information.

The affected consumer platform was already scheduled for retirement on December 20, 2026, following Gnosis Pay's decision to focus on enterprise card infrastructure, as outlined in a formal closure notice. The existing closure schedule remains unchanged, with the additional security measures expected to stay in place until then.

Prior Exploit and Industry Context

The incident follows a separate June exploit involving Gnosis Pay's Zodiac Delay Module, which resulted in approximately $1.5 million being stolen before Gnosis reimbursed affected customers. No connection between the two incidents has been established.

The breach also comes shortly after Chainalysis disclosed unauthorized access to customer information and 12 cryptocurrency websites were targeted by StepDrainer attacks. Taken together, the recent string of incidents spans both service-side data exposures and consumer-facing attack campaigns, placing the Gnosis Pay breach within a broader run of security events across the crypto sector.

Gnosis Pay has urged customers to avoid unexpected emails, calls and text messages requesting account verification or cryptocurrency transfers, even when those communications contain genuine personal details. The company maintains that wallet keys and customer funds were not compromised, but the exposure of financial and identifying information leaves affected users facing potential fraud and privacy risks beyond the December shutdown. The scale of the breach and the method of access remain undisclosed, and with misuse-detection monitoring still being arranged, those open items are the key details to watch in the run-up to the platform's retirement.

Source: Crypto Adventure