On this page
Key takeaways
- Gnosis Pay, which runs a Visa debit card that spends crypto from the user's own wallet, says its monitoring caught unauthorized access to the system behind its own-brand consumer cards on November 3, 2026. It says it began containing the intrusion within two hours.
- The company says customer funds were not affected, but personal information was. Breach notices reviewed by Cointelegraph listed names, home addresses, full card numbers with expiry dates and CVV codes, and the wallet addresses linked to each account. Gnosis Pay hasn't said how many people were hit.
- The bigger risk now is targeted scams, because the leak can link a real name and home address to known crypto wallets. Gnosis Pay's card wasn't offered to US residents, but the lesson applies to any crypto card: treat every unexpected message about your account as fake until you've checked it yourself.
Gnosis Pay, a company whose Visa debit card lets people spend crypto straight from their own wallet, says an intruder broke into the system behind its own-brand consumer cards. It says nobody's funds were touched. But the information that leaked can tie a person's name and home address to the crypto wallets they use, and that is exactly what scammers look for.
What happened
In a post on its blog and its verified X account on November 6, 2026, Gnosis Pay gave this account:
- November 3: its monitoring systems spotted unauthorized access to the system that runs Gnosis Pay-branded cards, its consumer business. Gnosis Pay says containment started within two hours.
- Since then: it says it replaced the affected security credentials and fixed the weakness the intruder used. It also says it stepped up monitoring of card activity and wallets, and made the extra 3D Secure check compulsory for every online card payment until the consumer system closes on December 20.
- November 6: it emailed every affected customer with exactly what had been taken from their account, told its partners, and says it is in contact with the relevant data protection authorities and its card issuer.
The company says the breach was limited to that consumer system and did not reach its enterprise platform, which runs white-label card programs for other businesses. "We sincerely apologise," it wrote.
What was exposed, and what wasn't
Gnosis Pay's public statement doesn't say which kinds of data were exposed. It says it told each customer individually. Cointelegraph reported that the breach notices it reviewed listed:
- customers' names and home addresses;
- full payment card numbers, expiry dates and CVV codes;
- the wallet addresses linked to each account;
- email addresses, phone numbers and nationality, and in some cases bank details (IBAN and BIC).
Lefteris Karapetsas, founder of the crypto portfolio tracker Rotki, posted part of his own notice on X. He said it listed his name and full home address, his card number, and all the wallet addresses tied to the account. CoinDesk and Cointelegraph both reported his post.
Not affected, according to Gnosis Pay: customer funds. One notice reported by Cointelegraph said the customer's card was canceled on November 3 and no suspicious transactions or fund movements were found.
Still unknown: how many customers were affected and how the intruder got in. Gnosis Pay hasn't said, and Cointelegraph reported that the company did not immediately respond to its request for comment.
Why a list like this matters
A card number can be canceled and replaced. A link between your identity and your wallets can't. Crypto transactions are public, so anyone holding a wallet address can look up its balance and history. Put that next to a name and home address and criminals know who holds crypto, roughly how much, and where they live. That makes phishing far more convincing, and it is why Gnosis Pay itself tells customers to be careful who they share their address or holdings with, online and offline. We've covered the physical side of this risk in our article on a Minnesota crypto kidnapping case.
It's not Gnosis Pay's first incident this year. In a July post-mortem, Gnosis said attackers took about $1.5 million on June 1 through a flaw in software modules used by Gnosis Pay's card wallets, and that Gnosis covered the losses and restored all user funds. Gnosis Pay hasn't said the two incidents are connected.
Does this affect US readers?
Probably not directly. When Gnosis Pay opened pre-orders in December 2023, it said the card was for residents of the European Economic Area, the UK and Switzerland, and that a US launch was only a plan. The card is issued in the UK and Europe by Monavate. A separate help page for the newer Gnosis Card still puts the United States on its list of countries planned for the future. The own-brand consumer card was already set to stop working at 23:59 UTC on December 20, 2026, under a notice sent to cardholders on September 21, as Gnosis Pay moves to running card programs for partner apps.
The lesson travels, though. Any crypto card, exchange or app that checks your ID holds the same kind of data: who you are, where you live and which wallets you use. Our recent article on the Keystone wallet customer data breach shows how quickly that becomes a scam target list.
How to stay safe after a leak like this
- Don't trust a message because it knows your details. Gnosis Pay warns that scam emails, texts, calls or letters may include your real information or a real purchase. Don't click their links; open the official app or website yourself.
- Never hand over your recovery phrase, keys, PIN or complete card number. Gnosis Pay says neither it nor its partner apps will ever ask for them, ask you to confirm who you are over email or text, or ask you to move funds.
- Ignore "move your funds to safety" requests. Gnosis Pay says it won't ever ask you to move money over email, text or a phone call, and that account changes happen only inside its official app. A message urging you to send crypto somewhere "safe" after a breach is a classic impersonation scam.
- Watch your card statements and report anything you don't recognize to your card provider.
- Keep quiet about your holdings. Don't confirm to callers that you own crypto, and think twice before posting about it.
Not sure about a message? Paste it into our free Scam Check, and read our guide to phishing and wallet drainers.
The takeaway
Based on Gnosis Pay's statement, no funds were taken, but personal and card details tied to crypto wallets were exposed for an unknown number of customers. The danger now is targeted scams, so treat any unexpected message about your account as fake until you've checked it through the official app. This is education, not financial advice, and it reflects Gnosis Pay's statement and news reports as of November 7, 2026.
Frequently asked questions
Was anyone's crypto stolen?
Gnosis Pay says no customer funds were affected. One breach notice shared publicly and reported by Cointelegraph said the customer's card was canceled on November 3 and that no suspicious transactions or fund movements were found. The company's enterprise platform, which runs card programs for other businesses, was not affected, it says.
Can people in the US get a Gnosis Pay card?
No. When it launched, Gnosis Pay said its card was for residents of the European Economic Area, the UK and Switzerland, with the US only a future plan, and its card was issued in the UK and Europe by Monavate. Gnosis's help page for its newer Gnosis Card still lists the United States as a planned market, not a current one. US readers are unlikely to be affected directly, but the same kind of data sits with any card or exchange that verifies your identity.
What should affected customers do?
Gnosis Pay says it emailed every affected customer with exactly what was taken from their account. It warns that scam messages may include your real details or a real purchase, so don't click links in them; go to the official web app or your partner app directly. It says it will never ask for your recovery (seed) phrase, keys, PIN or complete card number, never ask you to confirm who you are over email or text, and never ask you to move funds.
Is the Gnosis Pay card shutting down?
The own-brand consumer card was already scheduled to stop working at 23:59 UTC on December 20, 2026, under a notice sent to cardholders on September 21. Gnosis Pay is moving to running card programs for partner apps. Its notice says the assets in each user's Safe wallet are self-custodial and stay theirs.
Sources
- Data breach on the legacy system powering Gnosis Pay-branded cards (November 6, 2026) (opens in a new tab) — Gnosis Pay
- Gnosis Pay statement on the data breach (November 6, 2026) (opens in a new tab) — Gnosis Pay on X
- Gnosis Pay breach exposes card details, personal data and crypto wallet information (opens in a new tab) — Cointelegraph
- Gnosis Pay breach exposes card numbers, home addresses and linked crypto wallets (opens in a new tab) — CoinDesk
- Lefteris Karapetsas on the breach notice he received (opens in a new tab) — Lefteris Karapetsas on X
- Formal notice: closure of the Gnosis Pay web app and card (September 21, 2026) (opens in a new tab) — Gnosis Pay
- Gnosis Card: countries supported, restricted and on the roadmap (opens in a new tab) — Gnosis
- Who is eligible to pre-order the Gnosis Card? (December 14, 2023) (opens in a new tab) — Gnosis Pay on X
- Post-mortem: Gnosis Pay vulnerability exploit (July 3, 2026) (opens in a new tab) — Gnosis
Published November 7, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.
Dave McNaught
Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.