Gnosis Pay disclosed on November 6 that its legacy Gnosis Pay-branded consumer card system suffered unauthorized access on November 3, an incident that exposed personal information and the details of wallets linked to affected accounts. The company said customer funds were not touched. The disclosure appeared in a company blog post, and the firm repeated the same points in a statement on X. That disclosure came three days after the unauthorized access itself.

The affected stack is the company's direct-to-consumer card line, which is scheduled for shutdown on December 20, 2026. Its enterprise white-label platform, on which partner card programs run, was not affected. Containment began within two hours of detection, according to the company, which said it replaced the affected security credentials and fixed the flaw that enabled the access.

Company Response and Customer Notices

Until the scheduled retirement date, Gnosis Pay said it has raised monitoring on card activity and linked wallets and has made 3D Secure mandatory for all online card payments. The company said it emailed every affected customer, with each notice listing the specific data fields taken from that account. It also reported the incident to partners, the card issuer, and data protection authorities.

Funds were not affected, the company reiterated. It is arranging specialist monitoring for potential misuse of the leaked data and apologized for the exposure of personal information.

Exposure was not uniform across accounts. Rotki founder Lefteris Karapetsas posted his notice details on X, saying the email named his full home address and name and listed his card number and every wallet linked to the account. While the company's public note referred only to “certain customer information,” the individual emails itemized the fuller inventory. A combination of home address, card number, and linked wallet addresses is the kind of dataset that can support targeted phishing, and social engineering attempts can follow long after the underlying funds remain in place. The case also illustrates how a payments product built around self-custody can still generate a KYC-grade identity trail that sits alongside on-chain identifiers.

Customer Guidance

The company's advice to customers is direct: treat unexpected emails, texts, calls, or letters — including those referencing Gnosis Pay, a partner app, or the card — as suspect, even when they contain real personal details. Do not click links in such messages. Use the official web app or partner app only. Never share a seed phrase, private keys, PIN, or full card number. Gnosis Pay says it will never ask for those items, will never request identity “re-verification” by email or text, and will never ask customers to move funds through those channels.

Why the Legacy Stack Still Matters

The breach struck a branded card system weeks before its planned shutdown, not a distant archive. Users still on that direct-to-consumer path now carry leaked identity and wallet-linkage data into the final stretch before December 20. The retirement date closes the service, not the exposure — whatever was already leaked stays beyond the company's control after that date. Enterprise white-label partners were spared, which narrows the blast radius, but direct Gnosis Pay cardholders remain exposed.

The incident fits a pattern seen in other recent crypto security cases in which hot wallets are spared while users are still harmed: no drained balances, but ample usable personal data. Attackers who cannot move funds can still impersonate the brand, cite a real home address or a plausible card number pattern, and request a “security check” that is in fact an attempt to harvest a seed phrase. When a consumer-facing stack stores shipping details and linked wallets, a breach can still cause harm even when balances never move.

Gnosis Pay said the B2C system retires on December 20, 2026, and mandatory 3D Secure remains in force until then. For affected cardholders, the immediate risk is less the theft of funds than the follow-up messages that may arrive claiming to be from the company. Vigilance on inbound contact, the company indicated, matters as much as its assurance that balances were untouched.

Source: Live Bitcoin News