Gnosis Pay confirmed a data breach affecting its crypto debit cards on November 6, 2026. Attackers gained access to the system behind the Gnosis Pay-branded cards and viewed customer data. Ac
Gnosis Pay confirmed a data breach affecting its crypto debit cards on November 6, 2026. Attackers gained access to the system behind the Gnosis Pay-branded cards and viewed customer data. According to the company, funds were not affected. Cardholders therefore have no reason to pull their money in a hurry, but for the next few weeks they should treat every message about their card with deep suspicion: fraudsters can now approach them with genuine data.
The incident comes at an awkward moment. Gnosis Pay is shutting down its consumer business on December 20, 2026, and its own-brand cards will stop working after that date. Cardholders now face two tasks at once: guarding against phishing and finding a new card in time.
According to the statement from Gnosis Pay, the company's monitoring systems detected unauthorised access on November 3, 2026 to the system that runs the Gnosis Pay-branded cards. Gnosis Pay itself calls this unit its B2C business, meaning its business with retail customers. The access exposed "certain customer information", the company said.
The security team responded immediately, and containment began within two hours of detection. Gnosis Pay says it then rotated the affected security credentials and closed the vulnerability. The company has not yet disclosed how the attackers got in or who is behind the attack.
The case only became public three days after it was discovered. On November 6, Gnosis Pay emailed all affected customers, informed its partners and, by its own account, notified the relevant data protection authorities and the card issuer. The US trade publication The Block reported on the statement the same day.
The scope matters. Only the legacy system for the company's own-brand cards was affected. The enterprise platform, through which Gnosis Pay runs card programmes for other providers as so-called white-label cards, was not affected, according to the company. White-label means that a wallet provider or fintech issues the card under its own name while Gnosis Pay supplies the technology in the background.
In a post dated September 3, 2026, Gnosis Pay describes itself as the first self-custodial Visa card. Self-custody means the funds sit in an account on the blockchain that only the customer controls; no exchange or bank has access to it. At Gnosis Pay this is a smart contract account on the Gnosis blockchain, from which the card debits the amount at the point of payment.
The card is issued by Monavate Limited under a licence from Visa Europe. Monavate is authorised in the United Kingdom as an electronic money institution and supervised by the Financial Conduct Authority (FCA); Gnosis Pay itself is a British company. That is what the legal notice on the company's website states.
The model explains why Gnosis Pay describes funds as unaffected: anyone who breaks into the card operator's customer system does not thereby hold the keys to the accounts on the blockchain. It also explains why the breach is serious nonetheless. Every card account is tied to a public wallet address, and precisely this link between a person and an address is valuable to attackers.
Gnosis Pay has publicly disclosed neither the number of people affected nor the list of data types that were taken. The statement only refers to "certain customer information". Each affected person, however, was told by email exactly which information was taken from their account. The company also recommended further steps to customers depending on the type of data involved.
That defines the most important task for cardholders: read this email carefully, but click on nothing in it. Check the sender and compare the content with the statement on the official Gnosis Pay blog. Anyone who has not received an email is not affected, according to the company. If in doubt, Gnosis Pay names [email protected] as the contact address; type it in yourself rather than trusting a reply address from someone else's message.
It is also unclear whether the data is already circulating. Gnosis Pay says it is arranging specialised monitoring designed to detect signs that the data is being misused. No results from this monitoring have been published yet.
Anyone who knows a name and address can send fraud attempts by post as well, and Gnosis Pay explicitly warns about this.
An ordinary data breach at an online retailer involves names, email addresses and perhaps orders. At a crypto card provider there is an extra layer. A wallet address is public: anyone can look up in a block explorer which amounts it holds and which payments pass through it. As long as nobody knows who owns the address, that is harmless. Once a name sits next to the address, however, an anonymous string of characters becomes a bank statement that anyone can look up.
Gnosis Pay therefore explicitly advises its customers to be careful about whom they share their address or details of their crypto holdings with, online and offline. The reference to the offline world is no accident. Anyone who knows a person's name, address and balance can prepare targeted scam calls or send letters that look genuine. The same concern arose in earlier breaches, for example at service providers of hardware wallet manufacturers. How to order a device without revealing your home address is covered in our article on hardware wallets after the data breach.
Switching wallets can make sense. If the email from Gnosis Pay suggests that your name and wallet address were exposed together, you can move your funds to a new address that is not linked to you. The old address remains publicly visible, but new holdings no longer show up there.
The biggest risk after a data breach is rarely the access itself. The danger lies in the weeks that follow, when fraudsters use the stolen data to appear credible. Gnosis Pay warns customers to distrust every unexpected email, text message, phone call and letter about Gnosis Pay, a partner app or the card, even if the message contains real data or mentions a genuine purchase.
That last point is important. Many people spot phishing because the sender knows something they could not possibly know. After a breach, that no longer holds: a fake message can quote your full name, your address and even a payment you actually made. Genuine details therefore prove nothing any more.
Gnosis Pay sets out clear lines that help you identify a fake. Neither the company nor its partner apps will ever ask for your seed phrase, meaning the words used to recover your wallet, your private keys, your PIN or your full card number. Nobody will ask you by email or text message to confirm your identity again. And nobody will ask you by email, text message or phone to move money. According to the company, changes to your account are made exclusively in the official Gnosis Pay web app or in the relevant partner app.
Typical scams after an incident like this are fake security alerts ("Your account has been suspended"), supposed refunds for the incident, calls from a purported support team and requests to move your funds to a "safe" address. All of these messages have one thing in common: they want you to act quickly. Time pressure is the most reliable warning sign.
As a technical countermeasure, Gnosis Pay has made 3D Secure mandatory for all online payments with the card. 3D Secure is a procedure that requires an online card payment to be confirmed separately, usually in an app or with a code. Anyone who only knows the card details can no longer easily pay online with them.
The company says the requirement will apply until the consumer system is fully shut down on December 20, 2026. Gnosis Pay has also stepped up monitoring of card activity and wallets to detect fraud and attempts to get at customer funds. In practice this means: only confirm payments you have just initiated yourself. If a confirmation request appears while you are not buying anything, reject it and check your transactions.
Until the shutdown on December 20, Gnosis Pay requires 3D Secure confirmation for every online payment with the card.
What happened: On November 3, 2026, unknown parties accessed the system behind the Gnosis Pay-branded cards and viewed customer data. Gnosis Pay says it contained the access within two hours; according to the company, funds were not affected, and the number of people affected is unknown (as of November 6, 2026).
Are you affected? Customers with a Gnosis Pay-branded card may be affected. Anyone using a card through a partner app that runs on the enterprise platform is not affected, according to the company. Gnosis Pay informed all affected customers by email on November 6, including which data was taken.
Our guide how to store crypto safely explains the basics of secure storage, and the hardware wallet comparison compares suitable devices.
A data breach is not only a security problem; it also touches on your rights as a customer. Gnosis Pay is based in the United Kingdom, where the UK GDPR applies, which largely mirrors the EU General Data Protection Regulation in substance. Three rights are particularly relevant now.
The right of access under Article 15 GDPR allows you to request a list of all the data the company holds about you. That helps if you want to gauge what about you could be circulating beyond the details given in the notification. Under Article 77 you can lodge a complaint with a data protection authority; in Germany that is the authority of your federal state, which checks whether it is responsible or passes the case on.
Article 82 governs compensation for material and non-material damage. German courts have ruled several times in recent years on when a claim exists after a breach and how large it can be. Our article on compensation after a data breach at crypto services summarises the legal position. In any case, keep the email from Gnosis Pay: it proves that your data was affected, and which data.
Regardless of the breach, it was already settled that the Gnosis Pay-branded cards were being phased out. In September the company announced that it would focus on its role as a platform for other card providers and end its direct consumer business, including the web app. Future decisions about the card offering will then be made by the partners, meaning the wallet apps through which users obtain their card. Even then, Gnosis Pay advised web app users to switch to a partner app as early as possible.
According to the latest statement, the system now affected was due to be shut down on December 20, 2026 anyway, and that remains the plan. For cardholders this means the card will keep working with stricter checks until then; after that they need an alternative. Anyone who has linked the card to subscriptions, streaming services or regular payments has to switch each of these merchants individually.
When choosing a new card, three points deserve a close look: who issues the card, and is the provider authorised in the EU? Are the coins held by you or by the provider? And what fees apply when converting crypto into euros? Our comparison of crypto credit cards gives an overview of the offers, setting fees, cashback and custody model side by side.
The breach adds urgency to a switch that cardholders were facing anyway. These three steps will leave you properly set up before the deadline:
(As of November 6, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
