Crypto Card Breach Exposed Home Addresses and Every Linked Wallet

Gnosis Pay detected unauthorised access to the system powering its consumer Visa debit cards on 3 November 2026. The company said so in a blog post. It says customer funds were not affected.

That system was already six weeks from being switched off. Gnosis Pay has been moving away from running cards for individual customers. It now sells card programmes to wallets, fintechs and neobanks instead. The consumer system is due to retire on 20 December 2026.

The part that matters is what customers were told was taken. That is their names, home addresses, card numbers and the wallet addresses linked to their accounts.

• The news: Gnosis Pay says unauthorised access to its consumer card system on 3 November 2026 exposed customer information, not funds.
• The date to hold: that system retires on 20 December 2026, and 3D Secure is now mandatory for every online card payment until then.
• What happens next: the number of affected customers is still undisclosed, and the consumer card system shuts down on 20 December 2026 either way.

What Was Taken, and Why It Is Not Only Card Fraud

Card fraud needs a card number. A card number can be cancelled and reissued. What this breach put into circulation is a different set of details. According to customers' own notifications, it identifies a person, says where they live and points at what they hold on-chain.

Update (6 November): Lefteris Karapetsas is the founder of the portfolio tracker Rotki. He said the notification Gnosis Pay sent him listed his full home address, his name and his card number. It also listed every wallet address linked to the account. A screenshot he shared lists names, email addresses, phone numbers, home addresses and nationality. It also lists linked wallet addresses and account-verification and account-status information. For his card it lists the full card number, the expiry date and the CVV. CVV is the three-digit security code printed on the card. It says IBAN and BIC banking details were also viewed for customers who held an IBAN through Monerium. Those are the account numbers used for bank transfers.

The outlet that published the screenshot said it could not independently authenticate it. Gnosis Pay's post does not list the fields. The company says it emailed every affected customer. That email carried "exactly what information was taken from their account".

The wallet addresses matter because the chain is public. Gnosis Pay's own data guidance says transactions remain permanently visible on Gnosis Chain. Anyone can view them by looking up the Safe wallet address tied to an account. Anyone holding that address can see what has moved through it, without access to the account itself.

Why a Home Address Changes the Risk

A stolen card number is usually settled with a cancelled card and a chargeback. A home address next to a list of wallet addresses is a different problem. It tells someone where a crypto holder lives and which addresses are worth looking up.

Chainalysis counted more than $30 million stolen in physical attacks on crypto holders in the first half of 2026. Those attacks include home invasions and kidnappings, a pace it described as heading for a record year.

None of that is evidence that this breach has led to a theft, a phishing loss or an attack. No confirmed link between the two exists in any source read for this article. The notification Karapetsas described said a review found no suspicious card activity on his account. It said no funds moved.

Two Hours to Contain It, Then 3D Secure

Gnosis Pay says containment began within two hours of detection. Its security team replaced the affected credentials and fixed the vulnerability. The incident was limited to the consumer line. The enterprise platform behind its white-label card programmes was not affected. Those are the cards it builds for other companies to put their name on.

The company has since made 3D Secure mandatory for all online card payments. That is the extra step where a cardholder confirms an online payment in a banking app or with a one-time code. It says it has also increased monitoring of card activity and wallets. The aim is to detect fraud or attempts to access user funds.

In its post, Gnosis Pay said: "While funds were not affected, we recognise that the security of personal information is just as important." It says it has emailed affected customers and reported the breach to its partners. It is also communicating with the applicable data protection authorities and its card issuer.

The card is issued by Monavate Limited. The FCA authorises it as an Electronic Money Institution under FRN 901097. Gnosis Pay also warned customers to "be suspicious of any unexpected email, text, call or letter about Gnosis Pay, a Partner App or your card, even if it includes your real details or a real purchase". It said it will never ask anyone to move funds by email, text or phone.

The move away from consumer cards was planned before the breach. Sebastian Bürgel is Gnosis vice president of technology. He has said the group builds technical infrastructure well but is less good at distributing that technology to consumers directly.

What Is Still Unconfirmed

• How many customers were affected. Gnosis Pay has not published a figure. None of the sources read for this article carries one.
• The exact data set. The field-by-field list comes from a screenshot that has not been independently authenticated.
• Any regulator response. No FCA or data protection authority statement confirming the notification was found; Gnosis Pay says it is communicating with them.
• Any loss. No phishing loss, theft or physical attack has been confirmed as linked to this breach.

Karapetsas wrote that Gnosis Pay had already lost him as a user. He said it could at least have protected his data. Gnosis Pay's data-retention guidance says identity-verification and transaction records are kept for five years after an account is closed. That holds even when a customer asks for deletion.

The Date That Settles the Rest

20 December 2026 is the fixed point. That is when the consumer system is retired and the 3D Secure requirement goes with it. It is also the date by which Gnosis Pay's remaining consumer accounts stop existing.

What would settle the rest is a number: how many accounts were affected. The other is whether any exposed address has since been used in a phishing message that worked. Until Gnosis Pay publishes the first, the shutdown date is the only firm deadline on the calendar.