Gnosis Pay Confirms Card Data Breach, Mandates 3D Secure
Gnosis Pay disclosed that an intrusion into its legacy consumer card system, detected Nov. 3, exposed customer information. Funds and its enterprise platform were unaffected, but the company has not said how many customers were hit. 3D Secure is now mandatory for online payments.
Gnosis Pay says customer information was exposed when an intruder got into its legacy consumer card system, an intrusion the company detected on November 3, 2026, though no customer funds were affected. It disclosed the incident on Nov. 6 and has made 3D Secure, an identity-verification step for online card purchases, mandatory for all online card payments.
Containment began within two hours of detection, according to the company, which then replaced the affected security credentials and addressed the vulnerability. The breach was confined to the system behind Gnosis Pay-branded cards; the enterprise platform that powers white-label card programs for other businesses was not touched.
"While funds were not affected, the security of personal information is just as important and we take full responsibility,"
The statement came from Gnosis Pay's account on X.
Rotki founder Lefteris Karapetsas said earlier on Nov. 6 that his own exposed information included his name, home address, card number and every wallet address linked to his account. He posted the details on X.
Each affected customer was emailed on Nov. 6 with a list of what was taken from their account, but the company has not said how many customers that covers. Its public statement also did not list every exposed data category, name the intruder or explain how access was gained. No official Gnosis or Gnosis Pay statement has proposed payments or a vesting arrangement with the attackers; the public post instead invited researchers to report vulnerabilities through its bounty contact.
What customers are told to do
Gnosis Pay is increasing monitoring of card activity and wallets, and says it is arranging specialist monitoring for misuse of the exposed data. It is in contact with data-protection authorities and its card issuer. The tighter controls stay in place until the consumer system is retired on Dec. 20, a shutdown scheduled before the breach, and customers can export card transaction histories through the consumer web app until then.
The company warned users to distrust unexpected messages even when they cite real personal details or purchases. Support, it said, will never ask for seed phrases, private keys, PINs or full card numbers, and will never ask customers to move funds by email, text or phone. According to its data-retention guidance, identity and transaction records are kept five years after account closure, and support correspondence six years.
Why it matters
"Funds safe" is the right headline for a wallet, but a card breach is measured differently. A name, home address, card number and a list of linked wallet addresses together form something close to a ready-made targeting kit: a scammer can quote a real purchase and point at an on-chain balance, which makes a phishing message far more convincing. Until Gnosis Pay says how many customers were hit, the size of that exposure remains unknown.
The disclosure is separate from a June smart-contract exploit affecting Gnosis Pay wallets, after which Gnosis confirmed it restored the lost funds. Gnosis Pay had also already announced plans to discontinue consumer interfaces and move users to partner applications, so the breached system was on its way out. The incident joins a run of recent security failures, including the BTCPay Server hot wallet drains reported on Nov. 2.
