Gnosis Pay breach email lists card number, CVV and linked wallets

Gnosis Pay, a crypto debit card provider, says it detected unauthorised access to the system behind its own-brand cards on 3 November.Gnosis Pay, Data breach on the legacy system powering Gnosis Pay-branded cards, 6 November 2026. Its public notice describes what was exposed as “certain customer information”.

The email it sent to one customer is more specific. Lefteris Karapetsas, founder of the portfolio tracker Rotki, posted his on X.Lefteris Karapetsas, post on X, 6 November 2026. It lists “your name, email address, phone number, home address and nationality”.Gnosis Pay notification email, from the image in Lefteris Karapetsas’s post on X of 6 November 2026. It lists “the wallet addresses linked to your account”. And it lists “the full card number, expiry date and security code (CVV) of your card”. The email adds: “If you had an IBAN set up through our integration with Monerium, your IBAN and BIC details were also viewed”.

It says the breach “did not include copies of your identity documents or your date of birth”. His card was cancelled on 3 November. “Our investigation is now complete, and we have identified the information exposed,” the email says.

Gnosis Pay says each affected customer was told “exactly what information was taken from their account”, so other customers’ lists may differ. It has not said how many were affected.CoinDesk, Gnosis Pay breach exposes card numbers, home addresses and linked crypto wallets. OpenRate, a third-party tracker, showed about 7,000 monthly active cardholders on 9 November.OpenRate, Gnosis Pay card usage.

A card number can be cancelled and reissued. A wallet address stays where it is, on what the company’s privacy policy calls “a public distributed ledger”.Gnosis Pay, Privacy and Cookies Policy.

A card that settles in public

Gnosis Pay customers hold their money in their own wallet. “Each user receives a unique Safe account that acts as their on-chain wallet,” the company’s documentation says.Gnosis Pay documentation, GP Safe Account. A Safe is a wallet run by a smart contract, and this one is “the self-custodial Safe where the user’s funds are held”.Gnosis Pay documentation, Architecture.

That wallet’s activity is open to anyone. A token transfer on Gnosis Chain records the sending address, the receiving address and the amount, and its block gives the time.S-Curve read of public token transfer logs on Gnosis Chain, 9 November 2026. Anyone can request those records from a public node without an account. They carry no merchant, card number or name. A name attached to the address links that history to a person.

Gnosis Pay’s own description of card payments on the old system fits that picture. On 3 September, listing the benefits of a rebuilt platform, it wrote: “Today settlement is per transaction - visible and timestamped.”Gnosis Pay, The Next Era, 3 September 2026. The new design would work differently. “In future it will be collected once a day, with grouped payments that can’t be mapped or timed in the same way.”

The company’s privacy policy lists the personal data it processes: “Name, nationality, country of residence, home address, IP address, date of birth, place of birth, identification and KYC documents”. Wallet addresses are on the list too. Identity checks run through an outside provider, Sumsub. On the ledger itself, the policy says, “how you use and manage your cryptocurrency wallet address, rests solely with you”.

What Gnosis Pay did

The company says “containment began within two hours of detection” and that it then replaced the affected security credentials and addressed the vulnerability. It emailed affected customers on 6 November. It says it is “communicating with the applicable data protection authorities and with our card issuer”.

Until the old system closes, an extra verification step is “mandatory for all online card payments”. “We have increased our monitoring of card activity and wallets to detect fraud or attempts to access user funds,” the notice says. The company adds that “we are arranging specialist monitoring for any sign that information from this data breach is misused”. The platform it runs for other companies’ cards “was not affected”.

Karapetsas wrote on X: “You had already lost me as a user but you could have at least protected my data”.

The notice apologises. “While funds were not affected, we recognise that the security of personal information is just as important.” On X the company wrote “we take full responsibility”.Gnosis Pay, post on X, 6 November 2026.

Its advice to customers covers more than email. “Be suspicious of any unexpected email, text, call or letter about Gnosis Pay, a Partner App or your card, even if it includes your real details or a real purchase.” “Never share your seed phrase, private keys, PIN or full card number.” And: “Be careful who you share your address or details of your crypto holdings with, online and offline.”

A system already closing

The breached system “was already scheduled for retirement on 20 December 2026”, the notice says. Gnosis Pay had told cardholders in September that “Over the coming months the Gnosis Pay card will be wound up in favour of partner cards.” Customers will hold accounts and cards through partner apps instead. Rebind “is one of the first partners to confirm that they will migrate onto the new Gnosis Pay”, the company wrote. The once-a-day grouped settlement belongs to that new platform.

The notice does not say how access was gained. A cancelled card gets a new number. The wallet addresses stay on the ledger.