Gnosis Pay Breach Exposes Crypto Cardholder Data: Attackers Viewed Customer Information on the Legacy Consumer-Card System
Gnosis Pay says attackers reached its legacy consumer-card system on 3 November and viewed customer information; funds were untouched, but linking identities to wallet addresses sets up a wave of personalised scams before the December shutdown.
Overview
Gnosis Pay, the crypto-linked Visa debit card service, has disclosed unauthorised access to the legacy system that runs its own-brand consumer cards. The company says attackers were able to view "certain customer information". Account funds were not affected. Affected customers are being told individually by email which of their data was exposed.
The company has not said how many people are affected, how the attacker got in, or who is behind it. For cardholders the main danger now is follow-on fraud. Card data tied to self-custodial wallet addresses is valuable to scammers and to criminals who target crypto holders physically.
The Incident
- The breach hit only the legacy platform behind Gnosis Pay-branded (direct-to-consumer) cards.
- The company says its enterprise platform, which powers white-label card programmes for partner apps, was not affected.
- Monitoring detected the unauthorised access, and the company says containment began within two hours. It rotated the affected credentials and closed the vulnerability.
- The company informed partners, the card issuer and data protection authorities. It says it is setting up monitoring for misuse of the exposed data.
Gnosis Pay had already announced in September that it would close its direct consumer business and focus on being a card platform for other providers. That shutdown is still going ahead.
Timeline
- September 2026: Gnosis Pay announces it will end its consumer card business.
- 3 November 2026: Unauthorised access detected. Containment begins.
- 6 November 2026: Public disclosure. Affected customers, partners, the card issuer and regulators are notified.
- 20 December 2026: Scheduled full shutdown of the consumer system.
Threat Assessment for Customers
The exact data types differ per customer. For a crypto debit card, likely high-value combinations include identity details, contact details and wallet addresses. Linking a name and address to an on-chain address shows an attacker what that person holds, which raises the risk of:
- Targeted phishing that uses real customer details, making fake "security alerts" or "refunds" convincing
- Vishing from people posing as Gnosis Pay or partner-app support
- "Safe address" scams that push victims to move funds to an attacker-controlled wallet
- Postal fraud using exposed addresses
- Physical coercion risk for holders of large balances, which has become a real concern in crypto
Detection
For individuals:
- Treat any message about Gnosis Pay, the shutdown, refunds or "account verification" as suspicious, even if it contains correct personal details.
- Check 3D Secure prompts carefully. The company says 3D Secure is mandatory for online card payments until the shutdown. Reject any confirmation request for a purchase you did not start.
- Watch your linked wallet for unexpected approvals or token allowances.
For security teams at fintech and crypto firms:
- Expect phishing kits and lookalike domains themed on the breach and shutdown. Add Gnosis Pay brand terms to domain-monitoring watchlists.
Recommended Actions
- Never share seed phrases, private keys, card PINs or full card numbers. The company says neither it nor its partner apps will ask for them.
- The company says it will not ask customers by email, text or phone to re-verify identity or move money. Make account changes only in the official web app or the relevant partner app.
- Contact support only through an address or app you type or open yourself, never through links in messages.
- Think about moving funds to a new wallet address that is not linked to your identity, as the company itself suggests.
- Arrange a replacement card before 20 December and move subscriptions and recurring payments.
- Customers in the UK and EU can request a copy of the data held about them under GDPR Article 15 and complain to a data protection authority.
- Revoke unneeded token approvals on the linked wallet.
Analyst Assessment
Some key details are still unknown: the number of victims, the exact data types and the access vector. The breach hit a system the company was already planning to shut down. Legacy platforms in wind-down often get less security attention, and this incident is a reminder that they keep their data until they are fully decommissioned. Crypto-card customer databases are prime targets because they connect real-world identities to on-chain wealth. The most likely near-term impact is a wave of convincing, personalised scams timed to the December shutdown, not direct card fraud. Users should assume any message about the shutdown is hostile until verified.
