Gnosis Pay Says Hackers Took Customer Data From the Card System It Was Already Shutting Down
Gnosis Pay says attackers accessed customer data on the legacy system behind its own-branded cards on Nov. 3, but has not disclosed how many users or what information was exposed.
Crypto card provider Gnosis Pay disclosed on Friday that attackers accessed customer information on the system powering its own-branded consumer cards, the company said in a blog post and on X. Its monitoring detected the unauthorized access on Nov. 3, with containment beginning within two hours. Compromised credentials have since been replaced and the underlying vulnerability fixed, Gnosis Pay said. Customer funds were not affected.
The breach was confined to Gnosis Pay's consumer (B2C) business — a platform the company had already scheduled to retire on Dec. 20. Its enterprise arm, which supplies white-label card programs to fintechs, wallets and neobanks, was untouched, per the company.
Notably, Gnosis Pay has not said how many customers were hit or what specific data was exposed. It says it emailed each affected customer with details of what was taken. In the interim it has made 3D Secure, an extra verification step, mandatory for all online card payments until the consumer platform shuts down, and says it has stepped up fraud monitoring of card activity and wallets. The company says it reported the incident to its partners, its card issuer and data-protection authorities, and is arranging specialist monitoring for signs the data is misused.
Gnosis Pay warned customers to be wary of phishing — including messages that cite real personal details or purchases — and said it will never ask for seed phrases, PINs or full card numbers, or tell users to move funds. It also urged caution about sharing home addresses or details of crypto holdings, a nod to the physical "wrench attacks" Decrypt notes are on pace for a record year, citing Chainalysis figures of more than $30 million stolen in the first half of 2026.
Key facts
- Unauthorized access detected Nov. 3; containment within two hours (Gnosis Pay, via Decrypt).
- Breach limited to the consumer branded-card system; enterprise platform unaffected (Gnosis Pay).
- Consumer platform was already set to retire Dec. 20 (Gnosis Pay).
- Funds not affected; some customer information exposed (Gnosis Pay).
- Number of affected customers and data types: not disclosed (Decrypt).
- 3D Secure now mandatory on all online card payments until retirement (Gnosis Pay).
The real-world read
The account here comes almost entirely from Gnosis Pay's own blog post and X thread — an interested party — relayed by Decrypt; there's no independent forensic confirmation yet. Two things the company is foregrounding: that funds are safe, and that the hit landed on a legacy system it was killing off in six weeks anyway. Both are true and both are convenient. Neither answers the question that matters to customers — how many were affected, and exactly what was taken. "We take full responsibility" is easy to write; a count and a data inventory are not, and those are precisely what's missing. The breach also sits in a crowded week of crypto security incidents, so scrutiny is warranted, not reassurance.
Opinion, and whose
No forecasts or analyst takes were offered beyond the company's own characterization of its response. Gnosis Pay's framing that the exposure is contained and the affected platform near end-of-life is the company's assessment, not an independently verified one.
Sources
- Decrypt (Tier 2, secondary) — reported the disclosure, timeline and remediation steps, and supplied the broader breach context (Binance, Coinbase/Amplitude, Ledger, GitBook); itself citing Gnosis Pay's blog post and X posts, and Chainalysis for wrench-attack figures.
- Gnosis Pay blog post and @gnosispay on X (primary, but the subject of the story) — the company's own account of the incident and its response.
This is news reporting, not financial advice.