BTC
ETH
SOL
XRP
BNB
TON
DOT
LTC
POL
HBAR
NEAR
ARB
UNI
Gnosis Pay says data breach exposed customer records on legacy card system
Gnosis Pay has disclosed unauthorised access to the system behind its branded consumer cards, exposing customer details. The company says funds were not affected and the system was already due for retirement.
Why it matters: Crypto payment providers hold identity records that can be tied to public blockchain addresses, so a leak of names and home addresses carries privacy and safety risks even when funds stay safe.
Key points
- Gnosis Pay detected unauthorised access on 3 Nov 2026 and disclosed the breach on 6 Nov 2026, containing it within two hours.
- Rotki founder Lefteris Karapetsas says his name, home address, card number and linked wallet addresses were exposed.
- The affected consumer card system is due to be retired on 20 Dec 2026; the enterprise white-label platform was not affected.
Gnosis Pay has confirmed a data breach after unauthorised access to the legacy system behind its branded consumer cards, the company said in an update reported by Bitcoin.com News. The crypto payment provider says customer funds remain secure and that the intrusion did not reach the enterprise platform that runs its white-label card programmes.
Monitoring systems flagged the unauthorised access on 3 Nov 2026, and Gnosis Pay disclosed the incident on 6 Nov 2026. The company says its security team contained the intrusion within two hours, replaced affected credentials and fixed the vulnerability. It has not said how many customers were affected, notifying cardholders individually about which records were accessed.
Wallet addresses exposed
Lefteris Karapetsas, founder of the portfolio tracker Rotki, said the exposed data included his full name, home address, card number and every wallet address linked to his account. The combination of identity records with publicly traceable blockchain addresses creates scope for targeted phishing and impersonation, though the disclosures do not show the records have been misused.
Gnosis Pay has made 3D Secure verification mandatory for online card payments and stepped up monitoring of suspicious card and wallet activity until the consumer system is retired on 20 Dec 2026. It has told partners and its card issuer and contacted data protection authorities. The breach follows other 2026 crypto data incidents, including at Ledger, Safepal, Trezor, Keystone and Chainalysis.
What to watch: The affected consumer card system is scheduled for retirement on 20 Dec 2026, with the added 3D Secure checks and monitoring in place until then.
Live updates on NewsFeeds:MacroDesk editor: Keshav Aggarwal (accountable for this page; this summary was not edited by hand)
How this was produced: an AI model wrote this summary of Bitcoin.com News’s report, which we credit and link above. Read our Editorial and AI policy. Spotted a mistake? See Corrections.
Not investment advice. Read the risk disclaimer.