Gnosis Pay breach exposes cardholders’ addresses and linked crypto wallets

What happened

Gnosis Pay said its monitoring flagged unauthorized access on November 3 to the legacy platform that runs its consumer, Gnosis Pay-branded cards, and that it started containing the problem within two hours. It disclosed the breach publicly on November 6 and emailed affected customers. According to notifications reviewed by Cointelegraph, the leaked data included full card numbers, expiry dates and CVV codes, plus names, home addresses, emails, phone numbers, nationalities and the crypto wallet addresses tied to each account, and in some cases IBAN and BIC bank details. The company says customer funds and its enterprise card platform were unaffected. It has not said how many people were hit.

What it means

Accounts of what leaked do not fully line up. The company's own notice, as quoted by Protos, said exposed details varied by user and could include the name printed on the card, a shipping address and an account reference. Lefteris Karapetsas, founder of the portfolio tracker Rotki, said his notice listed his home address, card number and every wallet linked to his account. Cryptopolitan noted that Gnosis Pay had not itself confirmed whether security codes or bank details were taken.

The bigger worry is less about card fraud and more about privacy. When wallet details sit next to a name and street address, the leak can point criminals toward who holds crypto and where they live. That can fuel convincing phishing emails and, in the worst cases, physical threats. Cryptopolitan cited a Chainalysis estimate that violent attacks on crypto holders caused more than $30 million in losses by mid-2026, though it found no evidence tying those attacks to this breach. Gnosis Pay has warned customers about phishing and says it is arranging monitoring for misuse of the stolen data. Its cards keep self-custody of funds, meaning users control their own crypto, but the card company still stores identity records, and those are what leaked.

Gnosis Pay replaced compromised credentials, fixed the flaw and now requires 3D Secure, an extra identity step at online checkout, until the affected system shuts down on December 20. The company had already said in September that its consumer cards would stop working that day as it moves to running white-label card programs for other businesses. The breach is separate from a June smart-contract exploit in which attackers took roughly $1.5 million, losses Gnosis later covered, Cryptopolitan reported.

The incident lands as crypto cards grow fast. Cryptopolitan said tracked crypto-card spending nearly tripled to $1.37 billion in October from a year earlier, while Gnosis Pay's own October spending roughly halved to about $6.1 million. Data from OpenRate showed about 2,400 daily active cardholders. Other card providers, including Based and Rain, have reported security incidents in recent months, according to CoinCentral.

The bull case

The optimistic reading is that damage looks contained. Gnosis Pay says no money moved, it acted within two hours, canceled at least some exposed cards, added mandatory 3D Secure checks and notified issuers and data regulators. The affected consumer system was already due to close on December 20, and the business-facing platform the company is betting its future on was not touched, which could limit the long-term fallout.

The bear case

The pessimistic reading is that leaked identity data cannot be reset like a password. Customers' home addresses are now linked to their on-chain holdings, which may expose them to scams or worse for years. The company has not said how many users were affected, and this follows a costly exploit in June. Repeated incidents could weigh on trust in Gnosis Pay and in crypto cards more broadly.