Gnosis Pay Data Breach Exposes Sensitive Customer Info

GnosisGNO+0.00% Pay Confirms Security Incident on Legacy Consumer Card System

Crypto payment provider Gnosis Pay confirmed a security breach on Friday, November 6, 2026. The incident occurred after unauthorized parties gained access to the infrastructure powering its legacy consumer payment cards.

According to the company, automated monitoring systems first detected the intrusion on November 3, 2026. Security teams responded immediately and initiated containment protocols within two hours of detection. The team subsequently revoked compromised credentials and patched the underlying vulnerability.

Gnosis Pay emphasized that customer funds were not impacted by the incident and remain completely secure. At the time of reporting, market prices reflected BitcoinBTC-0.30% trading around $75,660 (-0.23%), EthereumETH-0.35% at $2,230 (-0.37%), and Gnosis (GNO) holding steady.

Which Platform Systems Were Affected?

The data breach was strictly confined to Gnosis Pay's business-to-consumer (B2C) card infrastructure. This specific system was already scheduled for full retirement on December 20, 2026.

Importantly, Gnosis Pay confirmed that its enterprise platform was not affected. The enterprise system powers all white-label payment card programs for partner organizations.

The company has not publicly released the exact total number of affected users or a full inventory of leaked records. Instead, Gnosis Pay is issuing direct, individualized notifications to each compromised cardholder detailing the specific account information accessed.

What Specific Personal Data Was Leaked?

While financial balances were unhurt, the nature of the compromised data presents serious privacy concerns. The leak revealed physical personal identities alongside linked blockchain wallet addresses.

Lefteris Karapetsas, founder of the open-source crypto portfolio tracker Rotki, publicly shared that his account details were among those compromised. He noted that the breach exposed his full legal name, home address, credit card number, and all cryptocurrency wallet addresses connected to his account.

Extremely disappointed. You had already lost me as a user but you could have at least protected my data…. Damn shame, really,

The disclosure prompted frustration across social media platforms. Users voiced concern over how personal records were stored and managed.

• One user on X reacted by asking: "Can you shut down tomorrow so there is no third hack please?"
• Another account posted: "What address should I use to sue the shit out of you?"

Why Linking Identity Data to Crypto Wallets Creates Unique Risks

This breach highlights an inherent tension in self-custodial crypto card platforms. While users retain control over their private keys, centralized backend payment tools still collect and store traditional personal identification data.

When centralized servers are breached, real-world customer identities can be linked directly to publicly viewable on-chain balances and transaction histories.

This data combination creates risks that go beyond standard card fraud, including:

• Highly targeted phishing scams using authentic names and residential details
• Identity impersonation attacks across other financial services
• Potential physical intimidation or home robbery threats based on exposed wallet balances

Gnosis Pay noted that available disclosures currently do not show evidence of exposed data being actively exploited for those purposes.

Safety Upgrades and Mandatory Security Protocols

To protect active cardholders prior to the system's December 20 retirement date, Gnosis Pay implemented mandatory 3D Secure verification for online transactions.

The team has also heightened continuous monitoring for unusual card transactions and suspicious connected wallet activities.

We sincerely apologise. We understand how serious it is to have your personal information exposed, and we deeply regret that this happened. While funds were not affected, we recognise that the security of personal information is just as important.

In addition to internal measures, Gnosis Pay contacted its card issuer, partner institutions, and data protection regulatory authorities. The company is performing a full security audit and contracting specialist surveillance services to monitor dark web forums for misused data.

Essential Guidance for Affected Customers

Gnosis Pay advised users to exercise extreme caution when reviewing incoming communications. Customers should remain wary of unsolicited emails, phone calls, text messages, or physical mail mentioning Gnosis Pay or partner apps.

Users are reminded to follow fundamental security hygiene:

• Never share wallet seed phrases or private keys under any circumstances.
• Never disclose card PIN numbers or full credit card details via email or chat.
• Remember that legitimate support staff will never request secret credentials or ask you to transfer funds.

Gnosis Security Context and Broader 2026 Industry Breaches

This incident follows a separate security event in June 2026 affecting Gnosis-related infrastructure, which led to approximately $1.5 million to $1.8 million in losses that Gnosis fully covered.

While the June breach involved direct financial loss, the November incident primarily threatens personal identity privacy. Retiring the legacy infrastructure prevents future intrusions on that software, but it cannot undo the public exposure of personal identity records.

The Gnosis Pay breach adds to a series of significant security leaks occurring across the crypto sector throughout 2026:

• Ledger exposed customer contact data in January 2026.
• SafePal experienced a data leak affecting roughly 40,000 customers.
• Trezor reported a breach involving details of approximately 81,000 users.
• Keystone suffered an October intrusion exposing nearly 26,000 buyer records.
• Chainalysis disclosed a breach involving user credentials and authentication tokens.