Gnosis Pay Reports Data Breach Exposing Card Numbers and Wallets
Leaked card data and wallet addresses could make targeted scams easier, while Gnosis Pay says customer funds were not affected.
Key Takeaways
- Gnosis Pay reported a data breach that exposed customers' home addresses, card numbers, and linked crypto wallet addresses.
- According to the company, customer funds were not affected; impacted users were notified about the leaked information.
- Gnosis Pay discovered the breach on November 3, contained it within two hours, and says the enterprise environment was not affected.
Gnosis Pay has reported a data breach that exposed customers' personal and financial information, including home addresses, card numbers, and linked crypto wallets. According to the company, customer funds were not affected, but the combination of real identities and wallet addresses could increase the risk of targeted scams.
What Was Leaked
Lefteris Karapetsas, founder of crypto portfolio tracker Rotki, said on X that the leaked data included his name, full home address, card number, and all wallet addresses linked to his account. He also shared an email from the company. Gnosis Pay did not disclose how many customers were affected, but it did say that every impacted user received a message with details about the exposed information.
The crypto debit card provider, which launched in 2023, lets customers spend stablecoins through Visa debit cards linked to their crypto wallet. According to Paymentscan, the platform processes about $67.6 million (€60.5 million) in payments per year. That makes it especially attractive for attackers looking to connect real personal data to crypto activity.
Gnosis Pay's Response
The company says it discovered the breach on November 3 and started containing it within two hours. It also replaced the affected security credentials and patched the leak that made the access possible. Gnosis Pay also says that the separate enterprise environment, which supports card programs for other companies, was not affected.
The notice comes shortly after an exploit in June, when about $1.5 million (€1.3 million) was drained through a bug in wallet software. Gnosis reimbursed those losses at the time and restored customer funds. Since then, the company has made 3D Secure verification mandatory for online card payments and stepped up fraud monitoring, while the legacy consumer system is scheduled to be phased out on December 20. Other crypto services have also shown how quickly a security incident can spill into customer data: Coinbase previously reported a data breach through a third party that exposed contact details for a small group of customers.
Why This Matters
For European crypto users, this incident shows how sensitive payment products are when card data and wallet addresses live in the same system. Even if funds are not directly affected, Gnosis Pay says this kind of information can be used to make messages seem more believable and target victims more precisely. That makes data breaches at crypto payment services not just a technical issue, but also a direct risk for users outside the blockchain itself.