Gnosis Pay Breach Exposes Card Numbers and Linked Wallets

Gnosis Pay data breach links identity to wallets

In its official incident disclosure, Gnosis Pay said containment began within two hours of detection. It replaced affected credentials and addressed the vulnerability. Its separate enterprise platform, which supplies white-label card programs, was unaffected, the company said.

The distinction between a wallet address and a private key is consequential. An address identifies an account on a public blockchain; it does not itself authorize spending. Connecting that address to a person’s residence and card details can nevertheless make a fraudulent approach more convincing.

The company has not publicly identified the attacker or supplied a detailed technical reconstruction. Its statement that funds were unaffected does not establish that exposed information can never be misused later. Equally, a data breach alone does not demonstrate that an attacker can sign transactions from the associated wallets.

Gnosis Pay said all online card payments now require 3D Secure, an additional verification step, through the legacy system’s retirement. That protection concerns card-payment authorization. It cannot make previously exposed personal information private again.

November exposure differs from June’s $1.5M exploit

The new disclosure concerns customer information. The earlier Gnosis Pay wallet-module incident involved unauthorized transfers, and its initial analytics estimate should not be carried forward as the final total.

Gnosis’s July 3 post-mortem said attackers extracted $1.5 million in the June 1 exploit, while about $300,000 more became inaccessible. Gnosis said it absorbed the losses and restored all user funds. Those historical amounts are separate from November’s disclosure.

That post-mortem traced the June attack to signature checks in the Delay and Roles modules used with card Safes. It said malicious contracts could make invalid approvals appear valid, enabling withdrawals from accounts the attacker did not own. The reviewed November statement does not attribute the data breach to that same mechanism.

Different failures call for different evidence. A wallet exploit can be assessed through unauthorized transfers and a reimbursement record. A customer-record breach also requires an accounting of which data fields were accessed, how many people were exposed and whether stolen details were subsequently used.

The broader card sector has experienced direct fund losses, including the Rain contract exploit affecting stablecoin neobanks. That precedent does not establish losses at Gnosis Pay in November, but illustrates why the two forms of exposure must be measured separately.

December 20 card closure leaves withdrawals open

The retirement predates the breach. Gnosis Pay’s September 21 formal notice says physical and virtual cards stop working at 23:59 UTC on December 20, 2026. The web app closes for functions other than withdrawals at the same time.

Joining a partner card program is optional and involves new terms, potentially different fees, limits and supported assets. Existing recurring payments will fail after the old card stops; users must update payment details with merchants themselves. The notice also recommends exporting transaction history before closure to support later disputes or refunds.

Gnosis Pay’s withdrawal guidance says there is no deadline for withdrawing funds. The card deadline therefore concerns spending access, rather than a forfeiture date for the assets held in a user’s Safe.

The transition creates another potential pretext for impersonation. The company’s card-security guidance warns about fake migration sites and unsolicited assistance. For suspected misuse, it describes a reversible card freeze inside the app, checking recent transactions and contacting support with the last four card digits. It says unrecognized transactions can be disputed.

Broader sentiment remained cautious: Alternative.me’s index showed 28, or Fear, when checked November 8, compared with 25 the previous day. The reading measures market sentiment, not the scale of this breach.

The next substantive checkpoints are an affected-customer count, a fuller incident review and any confirmed misuse of exposed records. Until then, the company assurance about funds and the customer’s report about exposed data describe distinct parts of an incident whose complete scope remains unknown.