Gnosis Pay data breach: funds safe, the card firm says, but users report card numbers and home addresses exposed

Update, 7 November 2026, 17:43 UTC: Cointelegraph, citing breach notifications it says it reviewed, reports that the data exposed in affected accounts included full card numbers, expiry dates and CVV codes, as well as email addresses, phone numbers, nationalities and, in some cases, IBAN and BIC details. Gnosis Pay has not confirmed any of this and did not immediately respond to Cointelegraph’s request for comment; its blog post, re-read on 7 November, still lists no data fields. CoinDesk reported on 7 November that the company fixed the flaw, without saying more about card data than Lefteris Karapetsas’s email.

Gnosis Pay, the company behind a Visa debit card that spends from a self-custodial Safe wallet, disclosed a data breach on Friday 6 November 2026: an intruder reached the system behind its Gnosis Pay-branded cards three days earlier, on 3 November, exposing “certain customer information”. In a statement on its blog, the firm says customer funds were not affected and that its enterprise platform, which runs the white-label card programmes of its partners, was not touched. It gives no number of affected customers, and its public statement does not say which data was taken.

The emails sent to customers fill part of that gap. Notices quoted by Protos say the exposure varied by user and covered the name printed on the card, the shipping address and the account reference. Lefteris Karapetsas, founder of the portfolio tracker Rotki, said on X that his own email listed more: his full home address, his name, his card number and every wallet address linked to his account. Cointelegraph, which says it reviewed several notices, reports a longer list for affected accounts, with full card numbers, expiry dates and CVV codes; the company has confirmed none of it. Keys stay with the user in self-custody; a delivery address does not.

Gnosis Pay data breach: what the company says happened on 3 November

According to the blog post, Gnosis Pay’s monitoring detected unauthorised access to the system powering its branded cards, which it calls its B2C business line. Containment started within two hours of detection. The company then replaced the affected security credentials and says it “addressed the vulnerability”. It has not described the flaw or said how long the intruder had access.

The breached system was already due to be retired on 20 December 2026. Until that date, Gnosis Pay says it has stepped up monitoring of card activity and wallets “to detect fraud or attempts to access user funds”, and it has made 3D Secure, the extra confirmation step at checkout, mandatory for every online card payment.

On 6 November the company emailed every affected customer “with exactly what information was taken from their account”, told its partners, and says it is communicating with “the applicable data protection authorities” and with its card issuer. A full review is under way, and Gnosis Pay is arranging specialist monitoring for signs that the stolen data is being misused. “While funds were not affected, we recognise that the security of personal information is just as important,” the post reads.

The official @gnosispay account also posted on X. According to Decrypt, which embedded the post, it said the breach affected “the system powering Gnosis Pay-branded cards (our B2C business line)” and that “everyone affected was sent an email today with full information”. Decrypt also quotes it as saying the company takes “full responsibility”.

What was exposed: four sources, four different lists

The blog post names no category of data. It only says additional actions were recommended based on “the specific information that was accessed”. The rest comes from the emails, which differ from person to person.

Protos, which reviewed notices shared by users, quotes them as covering “your name as printed on your card, your shipping address and your Gnosis Pay account reference”, with the scope varying by user. Protos asked Gnosis Pay for comment and had no answer at publication.

Karapetsas went further in a post on X. As reported by Protos, and in the headline of The Defiant, he said the email told him the exposed data included his full home address, name, card number and all wallet addresses linked to the account. CoinDesk, which also relied on the email he shared, quotes him as writing: “You had already lost me as a user but you could have at least protected my data.” CoinDesk does not say whether the card number was complete and does not mention expiry dates or CVV codes.

The heaviest claim comes from Cointelegraph. Citing breach notifications it says it reviewed, without publishing them, it reports that the exposed information included full payment card numbers, expiration dates and CVV codes, along with names, home addresses and the wallet addresses linked to affected accounts. It adds email addresses, phone numbers and nationalities, and, in some cases, bank details such as IBAN and BIC. It does not say how many notices it saw or whether every affected customer lost the same fields.

If that reading is correct, the leak went well beyond what Protos quoted. Gnosis Pay has not confirmed it: the company did not immediately respond to Cointelegraph’s request for comment, and its blog post still names no data category. One notice cited by Cointelegraph says that customer’s card was cancelled on 3 November, with no suspicious transactions or movement of funds detected. That is one account, not a company statement on all cards.

Cointelegraph also cites OpenRate data showing about 2,400 daily active cardholders and $263,200 in card transactions over the previous 24 hours. That gives the size of the card’s user base, not the number of people hit by the breach, which nobody has published.

Each column is a separate account of the emails, and none of them is a list of what every customer lost. Still unknown: how many people are affected, how the intruder got in, who it was, and whether any data has been used.

Why a leaked home address matters more than a card number

A card number can be cancelled and reissued. A home address cannot. If Cointelegraph’s reading is right, the card risk is real too: a number with its expiry date and CVV code is what an online shop asks for. The mandatory 3D Secure check, in place until 20 December, adds a step the holder must approve, which limits that risk without removing it. Gnosis Pay has not said whether exposed cards are being cancelled. Coins in a Safe still need the owner’s keys to move. But wallet addresses are public on chain, so anyone holding a list that ties a name and a street to those addresses can read the balances behind them. That is the starting point of a wrench attack, where criminals use threats or violence to make a holder sign the transfer himself.

France is where those attacks have clustered. Vanessa Perrée, the national prosecutor for organised crime (PNACO), said in April that at least 88 people, 10 of them minors, had been charged in connection with wrench attacks, 75 of them held in pre-trial detention across 12 cases, Cointelegraph reported on 27 April 2026. Her office recorded 18 incidents in 2024, 67 in 2025 and 47 in 2026 at that date. She urged holders to avoid “overexposure on social networks that could make them targets”.

Chainalysis, in figures reported by The Block on 6 August 2026, counted more than $30 million in crypto taken by violent criminals in the first half of 2026, against a full-year record of $58 million in 2025, and 30 publicly known French cases through mid-year, up from 19 in all of 2025. Interior Minister Laurent Nuñez had said in late June that the authorities had documented more than 70 crypto-related violent incidents. Chainalysis names a data compromise as the likeliest driver of the recent wave, citing among others the breach at the tax tool Waltio, which concerned some 50,000 users.

Nothing published so far links the Gnosis Pay breach to any attack or attempt. Gnosis Pay’s own advice to customers does point at the physical risk: be careful who you share your address or the details of your holdings with, “online and offline”.

Not the first incident around Gnosis Pay

Personal details of Gnosis Pay customers have leaked once before, through a supplier. In July 2024 an attacker got into a single operator account at Fractal ID, the identity-check provider Gnosis Pay used for KYC, and pulled user data that could include names, residence details, selfie scans and copies of passports, The Block reported on 17 July 2024. About 0.5% of Fractal’s 1 million users were affected, and Gnosis Pay warned its own customers by email.

The second episode was about money. On 1 June 2026, Gnosis co-founder and chief executive Martin Köppelmann confirmed “a hack related to Gnosis Pay and the ‘delay module'”, a Zodiac permission layer that lets Safe transactions be queued, and wrote: “Rest assured, Gnosis will cover all user losses.” The Block said the size of the loss was not confirmed at the time.

It also fits a run of leaks of customer contact data in the crypto sector this autumn, from the web-shop intruder at hardware wallet maker Keystone to the customer details exposed through Coinbase’s analytics vendor Amplitude.

The GDPR 72-hour rule and the regulators Gnosis Pay has not named

Under Article 33 of the EU General Data Protection Regulation, a data controller must report a personal data breach to its supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put people at risk. Article 34 adds that individuals must be told without undue delay when the risk to them is high. The UK version of the GDPR keeps the same 72-hour deadline.

The website footer names the operator as Gnosis Pay Co Ltd, a UK-registered company, and says the debit card is issued by Monavate Limited, an electronic money institution authorised by the Financial Conduct Authority. The company has not said which authorities it is talking to, or when it first contacted them. Customers heard about the breach on 6 November, three days after detection. Whether the regulators were told within 72 hours is not public, and there is no basis to say the rule was broken.

Under Article 77, customers in the EU can complain to the authority of the country where they live, such as the CNIL in France or the Garante in Italy; in the UK, the Information Commissioner’s Office.

What Gnosis Pay card holders can do now

Start from the 6 November email, which says which of your details were taken.

• Treat any unexpected email, text, call or letter about Gnosis Pay, a partner app or your card as suspect, even when it quotes your real name, address or a real purchase. Open the official web app or partner app yourself instead of clicking a link.
• Never give out your seed phrase, private keys, PIN or full card number. Gnosis Pay says it will never ask for them, never ask you to “re-verify” your identity by email or text, and never ask you to move funds by email, text or phone. Our guide to storing a recovery phrase covers the basics.
• Approve a 3D Secure prompt only for an online payment you started yourself, and check your card history for purchases you do not recognise.
• If your email lists your card number, expiry date or CVV code, watch every line of your card statements, and ask Gnosis Pay at [email protected] whether the card has been cancelled and whether a replacement will be issued. One customer’s notice, cited by Cointelegraph, said the card had been cancelled on 3 November.
• If your email lists wallet addresses, assume those addresses are now tied to your name and home. Funds you add later can sit at a fresh address that has never been linked to the card.
• Keep your holdings out of public view, on social networks and in conversation, as the French prosecutor advised.

Phishing that cites a real breach often follows leaks like this; our guide to crypto scams lists the red flags and where to report a scam. Gnosis Pay takes questions at [email protected].

The next fixed date is 20 December 2026, when the breached B2C system is due to be shut down and the extra controls are meant to end with it. Gnosis Pay has still to say how many people were hit and what the full set of stolen fields was.