Gnosis Pay disclosed on Friday, November 6, that attackers accessed customer personal data through the legacy system that powered its consumer cards. In an official statement, the company said that neither customer funds nor its business platform were affected. The disclosure comes amid a downturn in spending on Gnosis Pay cards even as the wider market continues to grow.

What Gnosis Pay says happened

According to the company, its monitoring system detected unauthorized access on November 3 and initiated a containment process two hours later. Gnosis Pay replaced compromised credentials, fixed the vulnerability, and made the 3D Secure service — the additional authentication step for online card payments — mandatory for all customers until the system was switched off.

Customers whose accounts were affected received emails containing specific information about which of their data had been compromised. Gnosis Pay also informed its partners, contacted the relevant issuer, and reported the breach to data protection authorities. The company's statement identifies Monavate Ltd and UAB Monavate as the regional issuers.

Two questions remain unanswered: the number of affected customers and the exact types of personal data exposed. Gnosis Pay has yet to clarify whether the volume of leaked information differed from one customer to another. It also said that customer funds and the card platform it operates for other companies were unaffected, though there has been no independent confirmation of those claims. Those outstanding details, together with any findings from the data protection authorities Gnosis Pay notified, are the main developments to watch as the breach response unfolds.

Why self-custody did not shield identity records

The incident highlights a flaw in self-custodial payment cards: customers may control the cryptocurrency in their wallets, but payment firms still retain their identity documents, addresses, and banking information — data that can be exposed without ever touching the funds. Other cryptocurrency wallet breaches have shown similar risks, including a recent phishing alert affecting Trezor users.

The possible consequences became evident when Lefteris Karapetsas, founder of Rotki, said in a post on X that his name, home address, card number, and every wallet address connected to his account were exposed. His case does not confirm what happened to other users, and Gnosis Pay has not officially confirmed whether email addresses, telephone numbers, card security codes, or banking details were leaked as well.

Linking someone's identity and home address to their crypto wallets creates another layer of risk. Criminals could use such information to send convincing phishing messages or identify potential targets. Chainalysis estimated that violent attacks on crypto holders resulted in more than $30 million in losses by mid-2026, although there is no evidence connecting those attacks to the Gnosis Pay breach.

A data breach, not the June exploit

The November breach is separate from the Zodiac smart-contract exploit that hit Gnosis Pay in June. Attackers exploited a software vulnerability to steal roughly $1.5 million, while another $300,000 became inaccessible. Gnosis later covered the losses and restored customer funds, as Cryptopolitan reported. Gnosis has also published a post-mortem of the vulnerability exploit.

The two incidents exposed different weaknesses. June's attack targeted the software securing card wallets, while November's breach exposed personal information stored in an older system. Gnosis Pay says no customer funds were stolen in the latest incident.

A shrinking card as the market expands

The system affected by the November breach was already scheduled for retirement. In September, Gnosis Pay announced in a formal notice that its consumer cards would stop working at 23:59 UTC on December 20. The web app will remain available for withdrawals as the company shifts its focus to providing card services for other businesses. For customers caught up in the breach, that schedule means the affected cards are already due to go offline on December 20, while the company's remaining card business runs on the platform it says was unaffected.

Gnosis Pay's consumer business was also losing ground. Its October card spending fell from $12.05 million in 2025 to about $6.1 million in 2026, a decline of nearly 50%.

The wider market moved in the opposite direction. Tracked crypto-card spending nearly tripled from $464 million to $1.37 billion over the same period. Meanwhile, Visa reported more than 160 stablecoin-linked card programs, with payment volume rising nearly 200% year over year — an expansion Cryptopolitan has also covered.

Because Gnosis Pay's spending decline began before the November breach, the figures cannot establish whether the incident affected customer activity. Its longer-term impact on the company's reputation and business remains uncertain.