Gnosis Pay breach exposed card numbers, home addresses and linked crypto wallets
Gnosis Pay (legacy B2C branded Visa debit cards)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Crypto debit-card provider Gnosis Pay said its monitoring detected unauthorised access on Nov 3 2026 to the legacy system powering Gnosis Pay-branded (B2C) cards, with containment starting within two hours. It published the disclosure on Nov 6 and said customer funds were not affected; its enterprise platform for white-label partner card programmes was outside the breach. Affected cards were blocked. Customer notices and reporting (CoinDesk, Cointelegraph) describe exposed full card numbers, expiry dates, CVV codes, names, home addresses and crypto wallet addresses linked to accounts, plus contact details and in some cases banking identifiers; Gnosis Pay says the exact fields varied by customer and emailed each person what was taken. It replaced compromised credentials, fixed the vulnerability, made 3D Secure mandatory for online card payments until the B2C system retires on Dec 20 2026, and is arranging monitoring for misuse.
Why this severity: Full card data plus home addresses tied to linked crypto wallets raises phishing and physical-targeting risk; funds not taken
- Started
- Nov 3, 2026
Affected
- Customers of Gnosis Pay-branded (B2C) cards on the legacy system; exact data types varied by account
Fixed in
- Access contained within ~2 hours of Nov 3 detection; credentials replaced and vulnerability addressed; 3D Secure mandatory until B2C retirement Dec 20 2026; affected cards blocked
Timeline3
CoinDesk and Cointelegraph report the disclosure, including customer notices listing full card numbers, home addresses and linked wallet addresses among exposed fields.
Gnosis Pay publishes the breach notice, emails affected customers with the data taken from their accounts, and makes 3D Secure mandatory for online payments until the B2C system retires on Dec 20 2026.
Gnosis Pay detects unauthorised access to the legacy B2C card system and begins containment within two hours; affected cards are blocked.
Advisories1
News & write-ups2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
