Skip to content
Blockchain Posts

exploit

Gnosis Pay discloses Nov 3 data breach on legacy card system; funds not affected

Gnosis Pay says unauthorized access to its legacy consumer-card system was detected Nov 3, exposing customer information. Funds are safe; the system retires Dec 20.

by 4 min read
exploitinfrastructuregnosisethereum

Gnosis Pay on November 6, 2026 disclosed a data breach affecting the legacy consumer-card (B2C) system that powers its Gnosis Pay-branded debit cards. Unauthorized access was detected on November 3, 2026, and contained within two hours. Customer funds were not affected. Primary source: the company's disclosure, "Data breach: Legacy system — Gnosis Pay-branded cards", with secondary coverage in The Block and Decrypt.

What happened

  • Detection: November 3, 2026, by Gnosis Pay's internal monitoring.
  • Scope: "Certain customer information" from the legacy B2C system. The company did not list the data fields or publish a total of affected users; it says each affected customer was emailed directly with the specific information taken from their account.
  • Funds: Not affected, per Gnosis Pay.
  • Enterprise platform: Gnosis Pay's white-label card infrastructure used by third-party partners is a separate stack and was not affected.
  • Attack vector: Not disclosed. The disclosure says the vulnerability was addressed and the affected security credentials were replaced.

Remediation

  • Containment started within two hours of detection.
  • Compromised security credentials replaced.
  • Vulnerability patched.
  • Enhanced card-activity and wallet monitoring.
  • 3D Secure verification is now mandatory for online card payments on the affected system until retirement.
  • Specialist monitoring is being arranged to watch for misuse of the exposed data.
  • Full internal review underway.
  • Partners notified; disclosure to relevant data protection authorities and the card issuer in progress.

The December 20 shutdown was already scheduled

The legacy B2C system was already scheduled for retirement on December 20, 2026 before this incident — the breach does not change that date. The company's framing: the system is deprecated infrastructure the company was already migrating customers off of, and the hardened controls stay on through sunset.

Gnosis Pay's enterprise platform for white-label card programs, which handles partner-issued products, is the forward-looking line and is unaffected.

Why it matters

Card programs sit at a specific risk perimeter: they bridge on-chain wallets to off-chain payment networks, which means breach scope touches PII tied to card-issuer KYC records and transaction history. Gnosis Pay's statement that funds were not affected matches the shape of a credentials/account-data breach rather than a wallet or signing-key compromise — the attacker got customer data, not the ability to move funds.

For card-breach pattern-matching, the material unknowns are: (1) the field list exposed, (2) the number of users, and (3) whether any token or wallet identifiers are in the exposed set. Gnosis Pay's "emailed with the exact information taken from their account" language suggests field-by-field variance across affected customers.

Action checklist

  1. Gnosis Pay B2C cardholders: check inbox for the direct email from help@gnosispay.com naming the exact data fields exposed from your account.
  2. Monitor card statements until December 20 retirement. The company has enforced 3D Secure on online card payments; continue standard review for anomalous charges.
  3. Treat the exposed PII as persistent — rotate passwords and 2FA on any service where that email address was reused.
  4. Enterprise customers of Gnosis Pay's white-label platform: no action required per the company; confirm with your Gnosis Pay account manager that the B2C stack isolation applies to your issuance path.

Context

Gnosis Pay has had a difficult year on the card side. A June 2025 Zodiac Delay Module incident on its on-chain infrastructure cost roughly $1.5M; the company said at the time the exploit did not touch cardholder funds. The current breach is on a different surface — the legacy off-chain card system, not the on-chain Safe/Delay-module stack — and again, the company says funds are intact. Card breaches of this shape (data-only, no fund movement) have been more common in 2026 than wallet or key compromises on card issuers; Coinbase's Amplitude analytics-vendor breach earlier this year is the closest same-year parallel.

Related stories