Gnosis Pay Data Breach Exposes Crypto Card Users’ Personal Data
Gnosis Pay, the crypto debit card that spends straight from a self-custody wallet, says an attacker broke into the system behind its own branded cards and took customer data.
The company spotted the unauthorised access on November 3 and disclosed it on November 6 in a blog post. No funds were affected, it says, and every affected customer got an email listing “exactly what information was taken from their account”. Publicly, Gnosis Pay hasn’t said how many people that is, which data was taken, or how the attacker got in.
One customer has filled in part of the picture. Lefteris Karapetsas, founder of the open-source portfolio tracker Rotki, shared his notice and says the leak covered his home address, card details and wallet addresses, The Defiant reports. Put together, those three tell a stranger who he is, where he lives and what he holds.
What Gnosis Pay Has Confirmed
The breach hit the system that runs Gnosis Pay-branded cards, the company’s consumer (B2C) business. Its security team started containing it within two hours, then replaced the affected credentials and “addressed the vulnerability”. Which vulnerability, it doesn’t say.
Cards issued through partner apps such as Rebind and MiniPay run on a separate enterprise platform, which the company says was not affected.
Until the consumer system shuts down, Gnosis Pay is watching card activity and wallets more closely, and 3D Secure checks are now mandatory for every online card payment. That makes a stolen card number harder to use in online shops. The company has informed its partners, its card issuer Monavate, an e-money institution regulated by the UK’s Financial Conduct Authority, and “the applicable data protection authorities”.
Why the Wallet Link Makes It Worse
With an ordinary bank card, a leaked card number and address mean phishing and the odd fraud attempt. A Gnosis Pay card is different, because it spends from a Safe smart account on a public blockchain. To order one, customers went through identity checks with the verification company Sumsub, with document uploads, a phone number and questions about the source of their funds, Gnosis Pay’s developer documentation shows.
Card payments settle on-chain as well. “Settlement is per transaction – visible and timestamped,” the company wrote in September. So whoever can tie a name to a card wallet can look up its balance and every payment made from it. Add a home address, and they also know where the owner lives. That is the link Karapetsas warns about, according to Phemex: data that connects his home address to his on-chain activity.
Gnosis Pay’s own advice points the same way. It asks customers to be careful who they share their address or crypto holdings with, “online and offline”. The offline part is not a figure of speech. Security firm CertiK counted 52 verified “wrench attacks” (robberies, home invasions and kidnappings that force victims to hand over crypto) in the first half of 2026, up from 39 a year earlier. Twenty were home invasions, and 33 happened in France, according to CertiK’s report.
This is the uncomfortable side of self-custody cards. The coins answer to nobody but you, yet to spend them by card, you hand a company a file that says who you are and where to find you.
A System Already on Its Way Out
The breached system was weeks from retirement. In September, Gnosis Pay announced that it would “close the consumer chapter, web app included” and asked cardholders to move to partner apps, which issue their own cards. The consumer system is due to shut down on December 20, 2026.
It is the company’s second serious incident this year. On June 1, an attacker exploited a flaw in the Zodiac modules behind Gnosis Pay’s card accounts and took about $1.5 million, with roughly $300,000 more left inaccessible, the post-mortem says. Gnosis absorbed the losses, and no user lost funds, according to the company.
Coins can be replaced, as Gnosis showed in June. A leaked home address cannot.
What to Do If You Have a Gnosis Pay Card
- Read the email. Gnosis Pay says every affected customer got one, listing what was taken from that account and extra steps for that data. If you aren’t sure whether you were affected, write to [email protected]; the company warns that replies may be slow.
- Treat every message about your card as suspect, even one that quotes your real details or a real purchase. Gnosis Pay and its partner apps will never ask for your seed phrase, private keys, PIN or full card number, never ask you to “re-verify” by email or text, and never ask you to move funds by email, text or phone. Open the official app yourself instead of clicking a link.
- Assume your card wallet is public knowledge. Its balance and history are on-chain, and the link to your name can’t be pulled back. Keep spending money on it, not savings. Sending funds straight from the card wallet to a new one ties the new one to you as well.
- Say less about your crypto, online and offline, as Gnosis Pay puts it. That includes posts that show what you hold or where you live.
- Decide before December 20. The Gnosis Pay-branded card system shuts down that day. If you want to keep a card, partner apps issue their own on the platform Gnosis Pay says was not hit.
Our Mission
We believe security online security matters and its our mission to make it a safer place.