# Gnosis Pay breach exposed card numbers, home addresses and linked crypto wallets · pwn.watch > Crypto debit-card provider Gnosis Pay said its monitoring detected unauthorised access on Nov 3 2026 to the legacy system powering Gnosis Pay-branded (B2C) cards, with containment starting within two hours. It published the disclosure on Nov 6 and said customer funds were not affected; its enterprise platform for white-label partner card programmes was outside the breach. Affected cards were blocked. Customer notices and reporting (CoinDesk, Cointelegraph) describe exposed full card numbers, expiry dates, CVV codes, names, home addresses and crypto wallet addresses linked to accounts, plus contact details and in some cases banking identifiers; Gnosis Pay says the exact fields varied by customer and emailed each person what was taken. It replaced compromised credentials, fixed the vulnerability, made 3D Secure mandatory for online card payments until the B2C system retires on Dec 20 2026, and is arranging monitoring for misuse. Page: https://pwn.watch/i/gnosis-pay-legacy-card-system-breach-nov-2026 · generated 2026-11-07T21:03:56.857Z ## Status - Severity: high · status: live · patch: partial - Product: Gnosis Pay (legacy B2C branded Visa debit cards) - Started: 2026-11-03 - Affected: Customers of Gnosis Pay-branded (B2C) cards on the legacy system; exact data types varied by account - Fixed in: Access contained within ~2 hours of Nov 3 detection; credentials replaced and vulnerability addressed; 3D Secure mandatory until B2C retirement Dec 20 2026; affected cards blocked ## Follow this incident - RSS (one item per update): https://pwn.watch/i/gnosis-pay-legacy-card-system-breach-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/gnosis-pay-legacy-card-system-breach-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/gnosis-pay-legacy-card-system-breach-nov-2026.json - This file: https://pwn.watch/i/gnosis-pay-legacy-card-system-breach-nov-2026/llms.txt ## Updates (newest first) - 2026-11-07: CoinDesk and Cointelegraph report the disclosure, including customer notices listing full card numbers, home addresses and linked wallet addresses among exposed fields. (https://www.coindesk.com/business/2026/11/07/gnosis-pay-breach-exposes-card-numbers-home-addresses-and-linked-crypto-wallets) - 2026-11-06: Gnosis Pay publishes the breach notice, emails affected customers with the data taken from their accounts, and makes 3D Secure mandatory for online payments until the B2C system retires on Dec 20 2026. (https://gnosispay.com/blog/data-breach-legacy-system-gnosis-pay-branded-cards) - 2026-11-03: Gnosis Pay detects unauthorised access to the legacy B2C card system and begins containment within two hours; affected cards are blocked. (https://gnosispay.com/blog/data-breach-legacy-system-gnosis-pay-branded-cards) ## Fix brief # Security brief: Gnosis Pay breach exposed card numbers, home addresses and linked crypto wallets Source: https://pwn.watch/i/gnosis-pay-legacy-card-system-breach-nov-2026 · status: live · severity: high · updated Nov 7, 2026, 19:17 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Crypto debit-card provider Gnosis Pay said its monitoring detected unauthorised access on Nov 3 2026 to the legacy system powering Gnosis Pay-branded (B2C) cards, with containment starting within two hours. It published the disclosure on Nov 6 and said customer funds were not affected; its enterprise platform for white-label partner card programmes was outside the breach. Affected cards were blocked. Customer notices and reporting (CoinDesk, Cointelegraph) describe exposed full card numbers, expiry dates, CVV codes, names, home addresses and crypto wallet addresses linked to accounts, plus contact details and in some cases banking identifiers; Gnosis Pay says the exact fields varied by customer and emailed each person what was taken. It replaced compromised credentials, fixed the vulnerability, made 3D Secure mandatory for online card payments until the B2C system retires on Dec 20 2026, and is arranging monitoring for misuse. Severity detail: Full card data plus home addresses tied to linked crypto wallets raises phishing and physical-targeting risk; funds not taken - Product: Gnosis Pay (legacy B2C branded Visa debit cards) ## Affected versions - Customers of Gnosis Pay-branded (B2C) cards on the legacy system; exact data types varied by account ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Access contained within ~2 hours of Nov 3 detection; credentials replaced and vulnerability addressed; 3D Secure mandatory until B2C retirement Dec 20 2026; affected cards blocked After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Gnosis Pay B2C card customers: use the emailed per-account notice, watch for phishing that cites real details, never share seed phrases or full card numbers, and treat unexpected contact as hostile. Enterprise/white-label partner programmes were not in scope. ## Latest updates - Nov 7, 2026: CoinDesk and Cointelegraph report the disclosure, including customer notices listing full card numbers, home addresses and linked wallet addresses among exposed fields. - Nov 6, 2026: Gnosis Pay publishes the breach notice, emails affected customers with the data taken from their accounts, and makes 3D Secure mandatory for online payments until the B2C system retires on Dec 20 2026. - Nov 3, 2026: Gnosis Pay detects unauthorised access to the legacy B2C card system and begins containment within two hours; affected cards are blocked. ## Advisories - [Data breach on the legacy system powering Gnosis Pay-branded cards](https://gnosispay.com/blog/data-breach-legacy-system-gnosis-pay-branded-cards) (Gnosis Pay) ## Write-ups & news - [Crypto debit card provider Gnosis Pay breach exposes card numbers, home addresses and linked crypto wallets](https://www.coindesk.com/business/2026/11/07/gnosis-pay-breach-exposes-card-numbers-home-addresses-and-linked-crypto-wallets) - [Gnosis Pay Data Breach Exposes Card, Wallet Details](https://cointelegraph.com/news/gnosis-pay-breach-exposes-card-details-personal-data-crypto-wallet-information) --- Machine-readable: https://pwn.watch/i/gnosis-pay-legacy-card-system-breach-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.