Gnosis Pay Data Breach Exposes Home Addresses and Wallets

The Gnosis Pay data breach hit its legacy card stack. Unauthorized access on November 3 exposed personal details and linked wallets. Funds stayed untouched. That is the stake for anyone still on the retiring Gnosis Pay-branded consumer card.

In a November 6 company post, Gnosis Pay said monitors caught unauthorized access on its branded-card system. A matching X statement repeated the same points. That stack is its direct-to-consumer line. Containment began within two hours of detection. The firm said it replaced affected security credentials and fixed the flaw. Its enterprise white-label platform was not hit. Partner card programs run on that platform.

What the Gnosis Pay Data Breach Confirmed

The breach sat on a retiring stack. Shutdown is set for December 20, 2026. Until then, the company said it raised monitoring on card activity and wallets. It also made 3D Secure mandatory for all online card payments.

Gnosis Pay said it emailed every affected customer. Each note listed what was taken from that account. It also reported the incident to partners, the card issuer, and data protection authorities. Funds were not affected, the company said. It is arranging specialist monitoring for misuse of the leaked data. It also apologized for the personal data exposure.

Customer advice from the firm is blunt. Treat unexpected emails, texts, calls, or letters as suspect. That includes notes about Gnosis Pay, a partner app, or the card. Real details in the message do not make it safe. Do not click those links. Use the official web app or partner app only. Never share a seed phrase, private keys, PIN, or full card number. Gnosis Pay says it will never ask for those. It will never ask for identity "re-verification" by email or text. It will never ask customers to move funds over those channels.

What Affected Customers Were Told

Exposure was not one uniform dump. Gnosis Pay said each notice listed the fields taken from that account.

Rotki founder Lefteris Karapetsas posted his notice details. It named his full home address and name. It also listed his card number and every wallet linked to the account. That mix is the dark punch of this incident. A payments front that sold self-custody can still leave a KYC-grade paper trail. Those details can sit next to on-chain identifiers.

The company's public note stayed at "certain customer information." The customer emails fill in the sharper inventory. Home address plus card number plus linked wallets is enough for targeted phishing. Social engineering can follow long after the money stayed put.

Why the Legacy Stack Still Matters

Why did it matter? The breach hit a branded card system weeks from planned shutdown. It was not a distant archive. Users still on that B2C path now carry leaked identity and wallet linkage. That risk lasts into the final stretch before December 20. Enterprise white-label partners were spared. That narrows the blast radius. Direct Gnosis Pay cardholders remain in the hot seat.

This case sits with other recent crypto hacks. Those cases spare the hot wallet and still wound the user. No drained balance. Plenty of usable personal data. Attackers who cannot move funds can still impersonate the brand. They can wave a real address or card digit pattern. Then they ask for a "security check" that is really a seed-phrase harvest.

New card rails change the surface. The old lesson holds. When a consumer stack stores shipping details and linked wallets, a breach still hurts. The first public fight is not only containment. It is whether customers treat the follow-up contact as the company. Or as the second act of the breach.

Gnosis Pay says the B2C system retires on December 20, 2026. Mandatory 3D Secure stays until then. Until that door closes, vigilance on inbound contact matters. It matters as much as the company's claim that balances never moved.