Gnosis Pay, a provider of crypto-linked Visa debit cards, disclosed on Nov. 6, 2026, that a security breach had exposed customers’ payment card details, home addresses and cryptocurrency wallet addresses. The company said customer funds and its separate enterprise platform for white-label card programs were unaffected.
According to the company, unauthorized access to its legacy consumer card system was detected on Nov. 3, and containment began within two hours. The number of affected customers was not disclosed.
What information was exposed?
Breach notifications reviewed by Cointelegraph identified the exposed information as including:
- Full payment card numbers, expiration dates and CVV codes
- Customer names, home addresses and linked cryptocurrency wallet addresses
- Email addresses, phone numbers and nationalities
- In some cases, banking details, including IBAN and BIC information
One notification confirmed that the recipient’s card had been canceled on Nov. 3 and that no suspicious transactions or movement of funds had been detected in that case.
Response and remaining questions
Gnosis Pay said it had replaced compromised security credentials, addressed the vulnerability and made 3D Secure verification mandatory for online payments until the legacy system’s planned retirement on Dec. 20.
The company also warned customers about phishing attempts that could use their personal or transaction details. It said it was arranging monitoring for potential misuse of the stolen data.
OpenRate, a third-party platform tracking crypto card activity, reported that Gnosis Pay had around 2,400 daily active cardholders and had processed $263,200 in transactions over the preceding 24 hours. Those figures describe platform activity, not the scope of the breach.
At the time of the report, Gnosis Pay had not immediately responded to Cointelegraph’s request for comment, and the total number of affected customers remained unknown.
Original source: Cointelegraph, published Nov. 7, 2026, at 04:51:23 UTC+8.