Gnosis Pay said on 6 November 2026 that unauthorised access on 3 November reached the legacy system behind its own branded cards. The catalog entry records a confirmed breach of that B2C line. The company says containment started within two hours, funds were not moved, and the separate enterprise platform that powers white-label cards was not affected. It has not published a headcount. Customer emails reported by Cointelegraph and CoinDesk list full card numbers, expiry dates, CVV codes, names, home addresses and cryptocurrency wallet addresses linked to the account. Some notices also listed email, phone, nationality and IBAN or BIC details. Fields varied by person.
Gnosis Pay is a UK-registered company. The debit cards are issued by Monavate under a Visa licence. The branded consumer system was already scheduled to retire on 20 December 2026. The company replaced affected credentials, fixed the vulnerability it has not named, made 3-D Secure mandatory for online card payments, and emailed every affected customer with the fields taken from that account. It reported the event to partners, the card issuer and data-protection authorities.
What happened in the Gnosis Pay data breach?
Monitoring flagged unauthorised access on 3 November 2026 to the stack that issues Gnosis Pay-branded cards, not the white-label platform used by partner apps. That distinction is the main containment claim. If you hold a partner-branded card rather than a Gnosis Pay-branded card, the public post says you are outside this incident. If you hold a Gnosis Pay-branded card, read the email from 6 November. It is the only place the company listed your specific fields.
The public blog is thinner than the customer emails. The blog says "certain customer information" and does not enumerate PAN or wallets. Trade press quoted those emails, including a notice shared by Rotki founder Lefteris Karapetsas that tied a home address and card number to every wallet linked to the account. Treat the blog as the official confirmation of access, timing and the enterprise exclusion. Treat the emails as the field list for people who received them.
This is a data breach, not a chain-drain of the June 2026 wallet-software exploit in which about $1.5 million moved and Gnosis restored funds. The company says no funds moved this time. Linking a home address to on-chain wallets still raises a physical and phishing risk that a lost card number alone does not. Compare that pairing with the Chainalysis credentials incident, where live tokens and identity metadata for investigators were the story, not consumer PANs.
See also WebMoney's possible payment-data notice the same week: another payments brand with unauthorised access and an unpublished census. The two are unrelated systems.
What data was exposed in the Gnosis Pay breach?
From customer emails reported in the press: name as printed on the card, shipping or home address, full card number, expiry, CVV, Gnosis Pay account reference, and linked wallet addresses. Some customers were told only name, shipping address and account reference. Some were told IBAN and BIC as well. The company said additional actions were recommended based on the specific information accessed. One reported email said the card was cancelled on 3 November with no suspicious transactions found.
The company has not said how many branded-card customers exist or how many emails went out. Third-party card trackers have published daily-active figures in the low thousands. That is not a census. recordsAffected stays at zero in the catalog until Gnosis Pay or a regulator publishes a count.
Who is affected?
Holders of Gnosis Pay-branded consumer cards whose data sat on the legacy B2C system. White-label partner programmes are excluded in the official post. People who never opened a branded card are not in this notice. If you received the 6 November email, you are in scope even if your card was already cancelled.
What should I do after the Gnosis Pay notice?
- Read the official email. It lists the fields taken from your account. Keep it.
- Open the Gnosis Pay web app or your partner app by typing the address. Do not use a link in a message, even one that quotes a real purchase.
- Assume the physical card is burned if PAN and CVV were listed. Use the replacement the issuer sends. Watch statements for the cancelled number.
- Never share a seed phrase, private key, PIN or full card number. Gnosis Pay says it will not ask for those by email, text or phone, and will not ask you to move funds that way.
- Be careful who you tell your home address and which wallets you hold. That pairing is the novel harm here. If IBAN details were listed, tell your bank.
The Mavis Tire notice post is a useful contrast: a US state filing with SSNs, not crypto wallets. Different data, same rule. The letter you received defines the fields, not a screenshot of someone else's email.
Frequently asked questions
Were funds stolen?
Gnosis Pay says funds were not affected and it is monitoring cards and wallets for fraud. A reported customer email said no suspicious transactions were found on that card.
Is the enterprise / partner platform in this breach?
The company says no. The access was limited to the branded B2C system due to retire on 20 December 2026.
Why do some emails list more fields than others?
The company says it told each affected customer exactly what was taken from that account. Do not copy a journalist's screenshot onto your own case.
How many customers were affected?
Unpublished. The catalog records zero until an official count exists.
What is 3-D Secure doing here?
Gnosis Pay made the extra online-payment check mandatory until the B2C system is retired. That is a fraud control on the card, not a fix for leaked wallet addresses.
Sourcing note: access date, containment, enterprise exclusion and 3-D Secure come from the 6 November Gnosis Pay blog. PAN, CVV and wallet fields come from customer emails reported by Cointelegraph and CoinDesk, not from the public blog's field list.