Gnosis Pay Eats $1.8M Loss for Breakfast, Refunds Every Affected Wallet 🍳

Gnosis Pay has confirmed that 5,281 wallets impacted by a June 1, 2026 security breach have been fully refunded, with the decentralized self-custodial payments network absorbing the entire loss. The incident resulted in the theft of approximately $1.5 million in digital assets from the platform's card safe infrastructure, according to a postmortem released Friday.

The first unauthorized transfer was flagged by Gnosis Pay's monitoring systems, operated by treasury manager NOCA, at 06:17 UTC on June 1. Engineers identified the root cause of the exploit within two hours of the initial alert, the company said, and card services were suspended shortly thereafter. The breach was traced to a vulnerability in a Zodiac module within the card safe's architecture.

Following the suspension, Gnosis Pay halted its bridge to Gnosis Chain and shared attacker wallet addresses with stablecoin issuers to assist with asset identification and potential recovery. The firm also notified external projects that could have been exposed to the same vulnerability. Refunds were distributed to all 5,281 affected wallets in stages over the following days, with Gnosis Pay covering 100% of the lost funds from its own reserves. In a statement accompanying the postmortem, the company said, "On 1 June, Gnosis Pay experienced a security incident affecting card accounts. All affected balances were restored."

The postmortem details the technical flaw that enabled the attack and outlines the security enhancements implemented in response. Gnosis Pay has restored card services and resumed normal operations, treating the incident as a closed matter from a user-funds perspective.