Key Takeaways
- Gnosis Pay detected unauthorized access on Nov. 3, 2026, and disclosed the data breach Nov. 6, initiating containment within two hours of detection.
- Rotki founder Lefteris Karapetsas reported that exposed information included his full name, home address, card number and linked cryptocurrency wallet addresses.
- The affected consumer card system is scheduled for retirement Dec. 20, 2026, while the company’s enterprise platform was reportedly unaffected.
What Happened to Gnosis Pay?
The cryptocurrency payment provider disclosed the incident three days after monitoring systems identified unauthorized access. According to Gnosis Pay’s data breach update, the intrusion affected its business-to-consumer (B2C) card infrastructure, rather than the enterprise platform supporting its white-label payment programs.
“On 3 November 2026, our monitoring systems detected unauthorised access to the system powering Gnosis Pay-branded cards (our B2C business line), resulting in the exposure of certain customer information,” the company explained.
Gnosis Pay stressed that its security personnel responded immediately, initiating containment within two hours of detection. The company subsequently replaced affected credentials and addressed the vulnerability responsible for the intrusion.
“The data breach was limited to the system powering Gnosis Pay-branded cards, which was already scheduled for retirement on 20 December 2026,” Gnosis Pay stated. “Our enterprise platform, which powers all of our white-label card programmes, was not affected.”
The company has not publicly disclosed how many customers were compromised, nor has it published a comprehensive inventory of exposed information. Instead, affected cardholders received individualized notifications detailing which account records were accessed.
Gnosis Pay Wallet Addresses Exposed Alongside Names and Home Addresses
The potential consequences extend beyond conventional payment-card fraud. Lefteris Karapetsas, founder of cryptocurrency portfolio tracker Rotki, reported that his compromised information included his full name, residential address, card number and every cryptocurrency wallet address associated with his account.
“Extremely disappointed. You had already lost me as a user but you could have at least protected my data…. Damn shame, really,” Karapetsas wrote.
The disclosure illustrates an uncomfortable contradiction surrounding self-custodial cryptocurrency payments. Although customers retain control of their digital assets, centralized payment infrastructure can still accumulate information connecting identifiable individuals to publicly traceable blockchain addresses.
Such combinations create opportunities for targeted phishing, impersonation and potentially physical intimidation, particularly when residential addresses accompany financial information. However, the available disclosures do not establish that the exposed records have already been exploited for those purposes.
Karapetsas wasn’t the only one disappointed. “Can you shut down tomorrow so there is no third hack please?” one X user replied to the Gnosis Pay X post on the subject. “What address should I use to sue the shit out of you?” another X account asked.
Gnosis Pay Adds 3D Secure Checks After Security Breach
Gnosis Pay has introduced mandatory 3D Secure verification for online card payments while increasing monitoring of suspicious card and wallet activity. These protections will remain active until the consumer system’s scheduled Dec. 20 retirement.
“We sincerely apologise,” the company declared. Gnosis Pay added:
“We understand how serious it is to have your personal information exposed, and we deeply regret that this happened. While funds were not affected, we recognise that the security of personal information is just as important.”
The provider also notified its partners and card issuer while communicating with relevant data protection authorities. Gnosis Pay said it is conducting a comprehensive security review and arranging specialist monitoring for evidence of stolen information being misused. The company cautioned:
“Be suspicious of any unexpected email, text, call or letter about Gnosis Pay, a Partner App or your card, even if it includes your real details or a real purchase.”
“Never share your seed phrase, private keys, PIN or full card number,” Gnosis Pay added, emphasizing that legitimate representatives will never request sensitive credentials or instruct customers to transfer funds through unsolicited communications.
The November disclosure follows a separate June 2026 incident involving Gnosis-related infrastructure that reportedly resulted in approximately $1.5 million to $1.8 million in losses, which Gnosis subsequently covered.
Unlike that incident, the latest breach principally threatens personal privacy rather than immediate asset custody. Nevertheless, the distinction offers limited comfort when compromised identity records can permanently associate individuals with transparent blockchain transactions.
Retiring vulnerable infrastructure may eliminate future exposure through that system, but it cannot reverse the disclosure of sensitive personal information. Gnosis Pay says customer funds remain safe, yet exposed identities, residential addresses, and cryptocurrency wallet connections present privacy risks that cannot simply be undone.
The Gnosis Pay incident follows a long string of crypto industry data breaches in 2026. Ledger exposed customer information in January, followed by Safepal’s leak affecting nearly 40,000 customers and Trezor’s breach involving roughly 81,000 people. Keystone suffered an October intrusion exposing nearly 26,000 buyer records, while Chainalysis disclosed a breach involving user credentials and authentication tokens.
