Gnosis Pay’s card data breach spares funds, but the personal-info cleanup is far from over 🪪

Gnosis Pay disclosed on Friday that hackers accessed customer information through the system powering its branded cards, saying the incident affected its consumer business but did not compromise customer funds. The company detected unauthorized activity on Nov. 3 and began containment within two hours, then replaced the compromised security credentials and fixed the vulnerability.

The breach was limited to the platform scheduled for retirement on Dec. 20. Gnosis Pay’s enterprise platform, which powers white-label card programs for fintech firms, wallets and neobanks, was not affected. The company did not disclose how many customers were involved or exactly what information was exposed, but said it emailed each affected customer with details about the data taken from their account.

“While funds were not affected, the security of personal information is just as important and we take full responsibility,” Gnosis Pay wrote on X. The company has increased monitoring of card activity and wallets for fraud, made 3D Secure mandatory for all online card payments until the consumer platform is retired, and reported the breach to its partners, card issuer and data protection authorities. It is also arranging specialist monitoring for signs of data misuse.

Gnosis Pay warned customers to treat unexpected messages about their cards cautiously, including messages containing genuine personal details or purchases. The company said it will never request seed phrases, PINs or full card numbers and will not ask customers to move funds. It also advised customers to limit the sharing of their address and details of their crypto holdings, both online and offline.

The disclosure follows several recent crypto security incidents. More than $30 million was stolen through physical “wrench attacks,” including home invasions and kidnappings, in the first half of 2026, according to blockchain analytics firm Chainalysis. The incidents came after the record-setting $6.4 billion hack of Binance, while Coinbase said last week that a breach involving analytics vendor Amplitude exposed some customer contact data. Last month, hardware wallet maker Ledger said all confirmed cases in a suspected $87 million drain involved devices purchased from CryptoBilis, a Southeast Asian reseller, and urged recent buyers to move their funds to new devices. Gnosis Pay’s breach also followed a June exploit that cost Gnosis $1.5 million, with another $300,000 left inaccessible.