CoinDesk
Gnosis Pay has disclosed a breach of its consumer card system that exposed customers' names, full home addresses, card numbers and every crypto wallet address linked to their accounts. The company detected the unauthorized access on Nov. 3 and says it contained the intrusion within two hours, replacing affected credentials and fixing the flaw that allowed it. Customer funds and the separate enterprise platform that powers card programs for other businesses were not affected, and the firm has not disclosed how many users were hit.
Lefteris Karapetsas, founder of crypto portfolio tracker Rotki, published the notification email he received and confirmed his own name, home address, card number and all linked wallet addresses were in the exposed set. "You had already lost me as a user but you could have at least protected my data," he wrote.
Why it matters
The sensitive part of this breach is not the card numbers, which can be replaced. It is the mapping between real-world identities and on-chain holdings. Gnosis Pay lets customers spend stablecoins through Visa debit cards linked to their crypto wallets, so the leak hands attackers precisely the correlation crypto users try to avoid. The company itself warned that scammers could combine the stolen personal details with past purchase information to make fraudulent messages appear legitimate. The service carries roughly $67.6 million in annualized payments volume, so the affected population is real, if unquantified.
Market impact
This is the second security incident at the company this year. A June exploit drained about $1.5 million through a wallet software flaw, with Gnosis covering the losses and restoring customer funds. The breach lands weeks before the branded consumer cards shut down on Dec. 20 as Gnosis Pay shifts focus to partner card programs. It has made 3D Secure verification mandatory for online payments and increased fraud monitoring, but partner programs will now be evaluating whether the underlying infrastructure deserves their brand.
Frequently asked questions
-
What data was exposed in the Gnosis Pay breach?
Names, full home addresses, card numbers and every crypto wallet address linked to affected accounts. Customer funds and the enterprise platform were not affected.
-
Were customer funds affected by the Gnosis Pay breach?
No. Gnosis Pay detected the intrusion on Nov. 3, contained it within two hours, replaced affected security credentials and fixed the flaw. Funds and the enterprise card platform were untouched.
-
How many Gnosis Pay customers were affected?
The company has not disclosed a number. It says it emailed each affected user individually with details of the information that was exposed.
-
Why does the Gnosis Pay breach raise scam risk?
The stolen data connects real-world identities and purchase history to crypto wallet addresses, letting attackers craft targeted phishing messages that appear legitimate.
-
Is Gnosis Pay shutting down its cards?
Branded consumer cards shut down on Dec. 20 as the company shifts to partner card programs. The breach follows a June exploit that drained about $1.5 million, losses Gnosis covered.
TheBlock
CoinTelegraph
WuBlockchain
Crypto News