Crypto Visa debit card provider Gnosis Pay has confirmed a security breach that exposed customers’ personal information. The breach was detected on its legacy consumer card system on November 3, 2026. Although the unauthorized access was contained within two hours, payment card numbers, home addresses, and customer crypto wallet addresses were accessed by external parties.
Despite the exposed user data, management assured that all customer funds remain safe with no missing balances.
What Data Was Exposed
The information accessed by the hackers was comprehensive, touching upon fundamental payment data. Gnosis Pay detailed that the breach included 16-digit payment card numbers, card expiration dates, and CVV security codes. In addition to card details, customer names, residential addresses, email addresses, phone numbers, and nationalities were also compromised.
Other banking details, such as customers’ IBAN and BIC codes, were also accessed by the attackers. The incident additionally exposed crypto wallet addresses, placing both conventional banking details and owner identities into third-party hands.
According to data from third-party tracker OpenRate, Gnosis Pay has around 2,400 daily active cardholders with a daily transaction volume of $263,200. Amid the breach in this consumer segment, the company confirmed that its enterprise card platform serving white-label partners was not affected.
Cards Immediately Cancelled and Vulnerability Patched
Gnosis Pay took immediate action on the day the breach was discovered. Through an official notification to customers, all cards indicated to be compromised were cancelled on November 3, 2026. To date, the company has not detected any suspicious transactions or illicit fund movements across their payment systems.
As an emergency mitigation measure, Gnosis Pay replaced all compromised security credentials and patched the underlying vulnerability. The company also enforced mandatory 3D Secure verification for all online transactions. These security requirements will remain in place until the legacy consumer card system is officially retired on December 20, 2026.
Phishing Threats Loom Following Data Breach
Even though user funds remain untouched, the leak of identity data introduces new threats to customers. Gnosis Pay warned all users of potential social engineering attacks or phishing scams leveraging the stolen data. Bad actors could exploit the leaked contact and identity details to deceive cardholders.
To mitigate the risk of losses, Gnosis Pay is preparing identity theft monitoring services for affected customers. For cardholders, remaining vigilant against suspicious messages or calls serves as the primary line of defense while system updates are fully rolled out.
Reported by Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
