Gnosis Pay Data Breach: What Crypto Card Users Should Know

Crypto card provider Gnosis Pay has disclosed a security breach affecting its consumer card system. Customer data including payment card details, home addresses and linked wallet addresses was exposed. The company says funds were not touched, but the incident is a reminder for traders that personal data leaks can create risks well beyond the card itself.

Key takeaways

• Gnosis Pay says unauthorised access was detected on 3 November and announced publicly on 6 November.
• Reported exposed data includes names, addresses, card numbers and linked wallet addresses; funds were reported as unaffected.
• The affected consumer card platform was already scheduled to close on 20 December 2026.
• Users are being warned to watch for phishing, even from messages that contain accurate personal details.

What happened

According to Cointelegraph, the Visa-linked crypto debit card provider disclosed the breach on Friday. Notifications reviewed by the outlet listed full card numbers, expiry dates, CVV codes, names, home addresses and wallet addresses tied to affected accounts. Other reports suggest the amount of data differed from user to user: one account of the company's notice describes some customers as having only their printed card name, shipping address and account reference exposed.

Gnosis Pay says it detected unauthorised access on 3 November to the system behind its Gnosis Pay-branded consumer cards and began responding within two hours. Its enterprise service, which supplies white-label card programmes to other businesses, was reported as unaffected. The company has not said how many customers were affected.

In a post on X, the company said that while funds were not affected, it recognises that protecting personal information matters just as much. It says it has emailed affected customers and informed its partners.

Why it matters beyond card fraud

Card numbers can be cancelled and replaced, but a link between a real name, a home address and public wallet addresses is harder to undo. Reporting on the incident notes that Gnosis Pay's own guidance says transactions stay permanently visible on Gnosis Chain. Anyone holding the leaked data could therefore connect a named person to onchain activity.

Security firm CertiK has previously warned, in an analysis of a separate leak, that exposed personal details can fuel targeted phishing. It also noted that knowing where a crypto holder lives can raise the risk of physical coercion. Gnosis Pay has told customers to be suspicious of unexpected emails, texts, calls or letters, even when they include real details or genuine purchases.

Rotki founder Lefteris Karapetsas publicly said his own name, address, card number and linked wallets were included in the notice he received, and criticised the company's data protection.

Market backdrop

There is no sign the breach moved major markets. At 21:03 UTC on 6 November, Bitcoin was at 75,811.00, down 0.27% on the day. Ethereum was at 2,227.68, down 0.64%. XRP was the weaker large-cap, down 4.50% at 1.1700, while Zcash gained 6.99% to 1,334.60. Those moves cannot be attributed to this story.

What to watch next

• Whether Gnosis Pay publishes how many customers were affected and the exact data fields involved.
• Any statements from regulators or data protection authorities; one report found none confirming the notification so far.
• The wind-down of the consumer card service, due on 20 December 2026, and what happens to user records afterwards.
• Whether other card providers review their own data storage and retention practices.

For card users, practical steps include treating unsolicited contact with caution, checking card activity regularly, and considering whether linked wallets reveal more than they would like.

Crypto markets are volatile and this article is for education only; it is not investment advice.