Gnosis Pay announced that its legacy consumer card system was accessed without authorization, exposing personal information of affected customers. The intrusion was detected on November 3, 2026, and the company publicly disclosed the breach on November 6, 2026.
Scope of the breach
The breach involved the business‑to‑consumer (B2C) card infrastructure that powers Gnosis Pay‑branded cards. The company stated that its enterprise platform, which supports white‑label card programs, was not impacted.
One affected user, identified as Rotki founder Lefteris Karapetsas, reported that his full name, home address, card number and linked cryptocurrency wallet addresses were compromised. Gnosis Pay confirmed that customer funds remain secure, but personal data was exposed.
Response and mitigation
Security personnel initiated containment within two hours of detection, replaced compromised credentials, and addressed the vulnerability that allowed the intrusion. The company also introduced mandatory 3D Secure verification for online card payments and increased monitoring of suspicious card and wallet activity. These measures will remain in place until the consumer system is retired on December 20, 2026.
Gnosis Pay notified its partners, the card issuer, and relevant data protection authorities. It is conducting a comprehensive security review and has arranged specialist monitoring for potential misuse of the exposed information.
Advice to customers
The provider warned customers to be cautious of unexpected communications requesting seed phrases, private keys, PINs, or full card numbers, emphasizing that legitimate representatives will never ask for such credentials.
Context
This breach follows several cryptocurrency‑related data incidents in 2026, including disclosures by Ledger, Safepal, Trezor, Keystone and Chainalysis. Unlike a prior June 2026 incident involving Gnosis‑related infrastructure that resulted in financial losses, the current breach primarily raises privacy concerns.
