Gnosis Pay disclosed on November 6, 2026 that an intruder reached the legacy system behind its Gnosis Pay-branded consumer cards.

The company says it detected the unauthorized access on November 3 and that containment began within two hours, with compromised security credentials replaced and the vulnerability fixed.

Customer names, home addresses, card numbers and cryptocurrency wallet addresses were exposed in the system serving its business-to-consumer card line. Gnosis Pay says customer funds were not affected and that its separate enterprise platform for white-label card programs was untouched.

The surprise is not a stolen coin balance but the pairing itself. A name alone is weak and a wallet address is public by design, but a single record linking a real identity and home address to a card number and a public transaction history de-anonymizes a cardholder instantly.

shattered.io notes that notification reports also listed expiration dates, CVV codes, emails, phone numbers, nationalities and, in some cases, IBAN and BIC banking details — details the company has not confirmed for every customer, since notifications apparently listed the specific fields taken from each account.

The best-known named victim is Lefteris Karapetsas, founder of the crypto portfolio tracker Rotki.

According to shattered.io, he said his record showed his name, full home address, card number and every wallet address linked to his account; The Defiant described his notice as including the full card number with its security code, a detail Gnosis Pay's own confirmed list does not name.

For a privacy-minded user, one database row did the work that years of operational security tried to prevent.

The crucial boundary: exposed wallet addresses do not let anyone spend. Moving assets requires a signature from a private key, and a card provider's database does not normally hold that key in a self-custody setup.

shattered.io reports that no account of drained wallets is confirmed and treats any such claim as unverified. The damage is privacy, not principal — anyone holding a record can now read a victim's balance, transaction history and counterparties on a public ledger.

The missing number is scale: Gnosis Pay has not said how many customers were affected.

The affected platform is scheduled to retire on December 20, 2026 — a retirement date that predates the breach, per the company.

Gnosis Pay has not published the root cause, the patched vulnerability, or how long the attacker was inside before detection, and customers whose notices list full card details with CVVs should seek replacements.

The incident lands in a record year: Pasquale Pillitteri's report on the Brenner Base Tunnel attack notes Clusit counted 4,911 cyber incidents worldwide in the first half of 2026, 105% more than a year earlier.