Gnosis Pay breach: full card numbers, expiry dates and CVV codes exposed, along with home addresses and linked crypto wallet addresses
Gnosis Pay disclosed on November 6, 2026 that unauthorised access to its legacy consumer card system, detected on November 3, exposed customer information including, according to the breach notifications it sent to affected customers, full payment card numbers, expiration dates and CVV codes, customer names, home addresses and cryptocurrency wallet addresses linked to their accounts; the company has not said how many customers were affected.
What happened
Gnosis Pay, which issues Visa debit cards that let customers spend from self-custodied cryptocurrency wallets, said on November 6, 2026 that its monitoring systems had detected unauthorised access on November 3 to the legacy system powering Gnosis Pay-branded cards — its consumer business line — resulting in the exposure of certain customer information. Containment began within two hours of detection, the company says; it replaced the affected security credentials and addressed the vulnerability, increased its monitoring of card activity and wallets, and made 3D Secure verification mandatory for all online card payments. On November 6 it emailed every affected customer with exactly what information was taken from their account, and said it had reported the breach to its partners, the applicable data protection authorities and its card issuer. The breached system was already scheduled for retirement on December 20, 2026. The company’s separate enterprise platform, which powers white-label card programmes for other businesses, was not affected, and customer funds were not affected. This is Gnosis Pay’s second security incident of 2026: in June, an exploit in wallet software modules drained about $1.5 million, which the company covered, restoring user funds.
Who is affected
Holders of Gnosis Pay-branded consumer cards. The company has not disclosed how many customers were affected, and the information exposed varied by customer. According to breach notifications reviewed by Cointelegraph, the exposed information included full payment card numbers, expiration dates and CVV codes, customer names, home addresses and wallet addresses linked to affected accounts, and also email addresses, phone numbers and nationalities, and in some cases banking details such as IBAN and BIC information. One affected customer, Rotki founder Lefteris Karapetsas, shared the notice he received: it listed his name, his full home address, his card number and every wallet address linked to his account. One notification also confirmed that the customer’s card was cancelled on November 3, and that no suspicious transactions or movement of funds had been detected.
How serious
A full card number together with its expiry date and CVV code is the complete set an attacker needs to attempt online card purchases, so the direct risk is payment-card fraud — partly blunted where cards have been cancelled and by the mandatory 3D Secure step the company has switched on for online payments. The second risk is targeted: a record that joins a person’s name and home address to their cryptocurrency wallet addresses lets anyone look up those wallets’ balances and history on public block explorers and aim convincing phishing or extortion attempts at people known to hold crypto. Gnosis Pay itself warns that scammers could use stolen personal details and past purchase information to make fraudulent messages appear legitimate. No seed phrases or private keys were reported among the exposed data, and the company says funds themselves were not taken.
What to do now
If you hold a Gnosis Pay-branded card, read the individual email the company sent you — it lists exactly what was taken from your account, and the steps it recommends depend on that list. Check your card statements and report anything unfamiliar to your card issuer promptly. Treat any unexpected email, text, call or letter about Gnosis Pay, a partner app or your card as unverified, even if it quotes your real details or a real purchase: do not use its links, and go to the official Gnosis Pay web app or your partner app directly. Never share your seed phrase, private keys, PIN or full card number — the company says it and its partner apps will never ask for these, and will never ask you to move funds by email, text or phone. Be careful about who you share your address or details of your crypto holdings with, online and offline.
Sources: Gnosis Pay, “Data breach on the legacy system powering Gnosis Pay-branded cards,” November 6, 2026 · Cointelegraph, “Gnosis Pay Data Breach Exposes Card, Wallet Details,” November 6, 2026 · CoinDesk, “Crypto debit card provider Gnosis Pay breach exposes card numbers, home addresses and linked wallets,” November 7, 2026