Gnosis Pay says attackers accessed customer data through legacy card system

According to Gnosis Pay, hackers breached personal information in the old system that powers its consumer cards. The attack was revealed on Friday, November 6, and the company claims that funds or its business platform were not affected. The statements are made amid a downturn in spending via Gnosis Pay’s card as the market continues to grow.

What Gnosis Pay says happened

According to Gnosis Pay, its monitoring system detected unauthorized access on November 3. It initiated a containment process two hours later. The company decided to replace compromised credentials, fix the vulnerability, and make the 3D Secure service mandatory for all customers until it turned off the system.

Customers whose accounts have been affected were informed through emails containing specific information concerning which data has been compromised. Gnosis Pay also informed its partners and contacted the relevant issuer and the data protection authorities about the data breach. It has been stated in the official statement of the company that Monavate Ltd and UAB Monavate are considered to be the regional issuers.

However, there are still two unanswered questions: What is the number of affected customers, and what kind of personal data has been exposed? Gnosis Pay has yet to clarify if the amount of the leaked information differed from one customer to another. Gnosis Pay said that funds held by customers and the card platform it operates for other companies have not been affected. However, there has been no independent confirmation of these claims.

Why self-custody did not shield identity records

The difference between safeguarding customer funds and ensuring the security of their personal data exposes a flaw in self-custodial payment cards. Customers may control the cryptocurrency within their wallets but the payment firms still retain their identity, addresses and banking information. This information could be revealed without having to touch the funds. Other cryptocurrency wallet breaches have also shown similar risks.

The possible outcomes became evident when Lefteris Karapetsas, the founder of Rotki, said that his name, home address, card number, and every wallet address connected to his account were exposed. His case does not confirm what happened to the other users. Gnosis Pay has not officially confirmed whether email addresses, telephone numbers, card security codes, and banking details were leaked as well.

Linking someone’s identity and home address to their crypto wallets creates another risk. Criminals could use that information to send convincing phishing messages or identify potential targets. Chainalysis estimated that violent attacks on crypto holders resulted in over $30 million in losses by mid-2026. However, there is no evidence connecting those attacks to the Gnosis Pay breach.

A data breach, not the June exploit

The November breach is separate from the Zodiac smart-contract exploit that hit Gnosis Pay in June. Attackers exploited a software vulnerability to steal roughly $1.5 million. Another $300,000 became inaccessible. Gnosis later covered the losses and restored customer funds, as Cryptopolitan reported.

The two incidents exposed different weaknesses. June’s attack targeted the software securing card wallets, while November’s breach exposed personal information stored in an older system. Gnosis Pay says no customer funds were stolen in the latest incident.

A shrinking card as the market expands

The system affected by the November breach was already scheduled for retirement. Gnosis Pay announced in September that its consumer cards would stop working at 23:59 UTC on December 20. The web app will remain available for withdrawals as the company shifts its focus to providing card services for other businesses.

Gnosis Pay’s consumer business was also losing ground. Its October card spending fell from $12.05 million in 2025 to about $6.1 million in 2026, a decline of nearly 50%.

The wider market moved in the opposite direction. Tracked crypto-card spending nearly tripled from $464 million to $1.37 billion over the same period. Meanwhile, Visa reported more than 160 stablecoin-linked card programs, with payment volume rising nearly 200% year over year. Cryptopolitan has also covered this expansion.

Gnosis Pay’s spending decline began before the November breach. The figures therefore cannot establish whether the incident affected customer activity. Its longer-term impact on the company’s reputation and business remains uncertain.