Gnosis Pay says the system behind its branded cards was breached

Gnosis Pay, a UK company that issues Visa debit cards linked to cryptocurrency wallets, said it found unauthorised access to the system that powers its own branded consumer cards. It detected the access on November 3, 2026. Customer funds were not taken, it said. The number of people affected has not been published.

What happened

In a statement posted on November 6, Gnosis Pay said:

• Monitoring flagged unauthorised access to the system behind Gnosis Pay-branded cards, its consumer (B2C) line.
• Containment began within two hours of detection. The company then replaced the affected security credentials and fixed the vulnerability.
• The same system was already scheduled to be retired on December 20, 2026. The separate enterprise platform, which powers white-label card programmes for other businesses, was not affected.
• Customer funds were not affected.
• On November 6 the company emailed every affected customer with exactly what information was taken from that person’s account. It also reported the breach to its partners and said it is communicating with the applicable data protection authorities and its card issuer.

The public statement does not list a single set of data types for every customer. It says each person was told what was reached in their own account, and that extra steps were recommended based on that information.

CoinDesk reported on November 7 that Lefteris Karapetsas, founder of the portfolio tracker Rotki, shared the email he received. He said the notice listed his name, full home address, card number and every wallet address linked to his account. That is one customer’s notice, not a company list of what every account lost. Other customers may have been told something different. CoinDesk also noted that the company has not said how many people were affected.

Gnosis Pay said it has increased monitoring of card activity and wallets, and that it has made 3D Secure mandatory for all online card payments until the consumer system is retired on December 20.

What this means for you

If your notice included a home address, a card number and wallet addresses together, someone who has that file can try to connect a real name and address to crypto holdings. That is useful for a targeted scam: a message that mentions your card, a recent payment, or a wallet, and asks you to “re-verify” or move funds.

Even if your notice listed less than that, a name and an address are enough to write a convincing fake email or letter.

What you can do

1. Read the email Gnosis Pay sent you, if you received one, for the exact items it says were reached. Compare unexpected contacts against that list. The company says it will never ask for your seed phrase, private keys, PIN or full card number, and will never ask you to move funds by email, text or phone.
2. Be suspicious of any unexpected email, text, call or letter about Gnosis Pay, a partner app or your card, even if it includes real details. Do not click its links. Open the official Gnosis Pay web app or your partner app yourself.
3. Watch card and wallet activity. The company says it has stepped up that monitoring. You can also review recent charges with the card issuer if something looks wrong.
4. If your notice included a card number, ask the issuer about a replacement if that option is offered, and keep 3D Secure turned on for online payments.
5. See how scammers use leaked data to make a message feel personal if a note arrives that seems to know your address or your card.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each service its own address, so a fake message that arrives at the wrong one stands out. Frame never collects or stores the leaked records themselves.

Related coverage

• Revolve says saved card numbers may have been taken from shopper accounts: another case where card numbers, not only contact details, may have been reached.
• How scammers use leaked data to make phishing personal: why a real address or a real card detail makes a fake message harder to dismiss.

Sources

• Gnosis Pay, Data breach on the legacy system powering Gnosis Pay-branded cards, November 6, 2026
• CoinDesk, Crypto debit card provider Gnosis Pay breach exposes card numbers, home addresses and linked wallets, November 7, 2026