Gnosis Pay Data Breach Exposes Debit Card Numbers, Personal Information and Crypto Wallets

Cryptocurrency debit card issuer Gnosis Pay has disclosed a cybersecurity incident that exposed sensitive user records, including payment card credentials, crypto wallet addresses, and personal identification data. Company officials confirmed that unauthorized access was identified on November 3 and brought under control shortly after detection. Despite the severity of the data exposure, the firm stated that user balances and underlying digital assets were not compromised.

The compromised information varied depending on the individual account holder but encompassed a broad range of personal and financial records. Exposed data included full payment card numbers, card expiration dates, card verification value (CVV) codes, and linked cryptocurrency wallet addresses. In some instances, international bank account numbers (IBANs), bank identifier codes (BICs), home addresses, phone numbers, and customer nationalities were also accessed by the intruder.

Gnosis Pay said technical teams contained the intrusion within two hours of its discovery, immediately revoking compromised credentials and patching the vulnerability that permitted unauthorized entry. The provider has since instituted mandatory 3D Secure verification across all online transactions processed through the system to prevent unauthorized card-not-present purchases. Account holders whose information was caught up in the leak have received direct notifications outlining the specific records involved.

Crucially for users, the architecture of Gnosis Pay kept user funds isolated from the compromised database. Because card balances rely on decentralized smart contract mechanisms rather than custodial bank storage within the affected database, attackers could not siphon on-chain holdings directly. The breach was strictly confined to off-chain data infrastructure and card management interfaces.

Company disclosures revealed that the incident specifically impacted a legacy consumer card system that Gnosis Pay had already slated for decommissioning. The business has been actively transitioning away from its original direct-to-consumer card offerings in favor of enterprise infrastructure. The affected legacy consumer program is scheduled to shut down permanently on December 20.

Gnosis Pay emphasized that its enterprise operations and developer platform were entirely insulated from the incident. That infrastructure powers white-label payment programs and institutional partner deployments, operating on separate environments and distinct security controls. Partner organizations utilizing the newer business architecture experienced no disruptions or data exposure.

Even though funds remain secure, cybersecurity experts warn that the exposure of high-fidelity financial profiles poses significant secondary risks for affected consumers. The combination of verified cryptocurrency wallet addresses, real-world contact details, and payment card numbers makes victims prime targets for sophisticated phishing campaigns and identity theft schemes. Industry observers note that bridging traditional payment rails with decentralized networks creates dual attack surfaces that require rigorous safeguards.

In light of the incident, Gnosis Pay urged affected customers to remain exceptionally vigilant against suspicious emails, direct messages, and phone communications that reference their transaction activity. Customers have been advised to monitor connected bank accounts and payment channels for anomalous activity and to consider requesting replacement cards where appropriate. The company noted that legitimate staff will never request seed phrases, private keys, or passwords.

The incident highlights the growing operational challenges fintech and crypto firms encounter as they maintain legacy software alongside modern digital asset protocols. As Gnosis Pay prepares to shutter the impacted consumer platform next month, the company indicated it will continue working with forensic specialists to audit its systems. Regulators and industry analysts are expected to track the aftermath as the broader digital payments sector grapples with persistent privacy vulnerabilities.