No funds, plenty of phish: Gnosis Pay breach turns card data into bait

Gnosis Pay disclosed Friday that hackers accessed customer information through the system supporting its branded cards, with exposed data including full payment card numbers, expiration dates, CVV codes, customer names, home addresses, wallet addresses, email addresses, phone numbers and nationalities. Some notifications also included banking details such as IBAN and BIC information, although Gnosis Pay did not disclose how many customers were affected. The company said customer funds were not affected.

The company detected unauthorized access on Nov. 3, 2026, and began containment within two hours. Gnosis Pay said it replaced compromised security credentials, addressed the vulnerability and emailed each affected customer with details about information taken from their account. At least one customer’s card was canceled on Nov. 3, with no suspicious transactions or movement of funds detected.

“We are arranging specialist monitoring for signs of data misuse, while our enterprise platform, which powers white-label card programs for fintech firms, wallets and neobanks, remains unaffected,” Gnosis Pay said in a statement. The company has increased monitoring of card activity and connected wallets and made 3D Secure verification mandatory for all online card payments until the consumer platform’s planned retirement on Dec. 20. Gnosis Pay warned customers about phishing attempts that may include real personal or transaction details and said it will never request seed phrases, PINs or full card numbers, or ask users to move funds. According to OpenRate, Gnosis Pay had around 2,400 daily active cardholders and processed $263,200 in transactions over the previous 24 hours.

The disclosure followed a June exploit that cost Gnosis $1.5 million, with another $300,000 left inaccessible. It also comes amid a broader series of crypto security incidents. A record-setting $6.4 billion hack affected Binance, described as the world’s largest crypto exchange, while Coinbase said a breach at analytics vendor Amplitude exposed some customer contact data. Hardware wallet maker Ledger said all confirmed cases in a suspected $87 million drain involved devices bought from Southeast Asian reseller CryptoBilis.

Physical “wrench attacks” targeting crypto holders, including home invasions and kidnappings, were on pace for a record year after more than $30 million was stolen in the first half of 2026, according to blockchain analytics firm Chainalysis. Gnosis Pay said it reported the breach to its partners, card issuer and data protection authorities.