TL;DR:
- Impact on the B2C line: Gnosis Pay formally notified its users about a security incident that exposed names, physical addresses, card numbers, and linked wallet addresses.
- Fund integrity: The payment provider confirmed that digital assets held under user custody suffered no direct theft during the breach.
- Scheduled sunset: The consumer card platform will maintain heightened monitoring protocols until its final shutdown scheduled for December 20, 2026.
This Friday, November 6, a Gnosis Pay data breach was confirmed, stemming from unauthorized third-party access to the infrastructure supporting its direct-to-consumer (B2C) division.
The incident was reported by the crypto card issuer through its institutional channels and via individualized email notices sent to each affected cardholder. Management detailed that the attack was concentrated on the servers responsible for managing branded cards for the retail segment.
The official statement from Gnosis Pay indicates that the security breach resulted in the improper extraction of certain customer identification records. The company affirmed that no diversion of capital or loss of user-deposited funds occurred.
Accounts from affected users and posts by industry developers on social media indicated that the breach included full names, residential addresses, card numbers, and linked wallet address records. The founder of crypto accounting platform Rotki, Lefteris Karapetsas, publicly questioned the data protection protocols after receiving formal notification from the company.
According to the firm’s technical report, private keys, seed phrases, and security PIN codes were not exposed in the intrusion. The firm reminded its clients that its technical support team will never request passwords or additional transfers under any circumstances.
Contingency Measures and Operational Transition
Following the detection of the incident, Gnosis Pay leadership implemented additional technical control mechanisms. Notable among the immediate adjustments was the strict enforcement of 3D Secure (3DS) authentication protocols for all payments processed through e-commerce platforms.
Transaction activity monitoring on wallets associated with its cards was also stepped up. The firm’s technical documentation notes that these provisions will remain active continuously to safeguard remaining operations for the current user base.
The incident occurs in the context of a scheduled withdrawal from the retail market that had already been planned by the organization. Gnosis Pay had previously announced its intention to shut down its B2C commercial card service. The company’s roadmap stipulates that the web application and card service will cease operations on December 20, 2026, at 23:59 UTC.
The underlying Safe Smart Account smart contract infrastructure allows users to withdraw their balances autonomously to addresses on the Gnosis Chain network. The entity’s official guidelines advise cardholders to transfer their stablecoin balances, such as EURe, to external wallets before the definitive shutdown of the user interface.
Gnosis Pay will maintain assisted support channels to handle inquiries and verify transactions until the deadline set for the closure of its retail platform on December 20, 2026.
