✓ Verified by 4+ outlets
Gnosis Pay says hackers accessed customer data on its branded-card system; funds untouched
Summary
Crypto card provider Gnosis Pay said Friday that unauthorized access on Nov. 3 hit the legacy system powering its own branded debit cards and exposed certain customer information, Decrypt and The Block reported, citing the company's disclosure.
Both outlets said containment began within about two hours, compromised security credentials were replaced, the vulnerability was fixed, and customer funds were not affected; Gnosis Pay's enterprise platform that powers white-label card programs for fintechs and neobanks was untouched.
Decrypt said the consumer platform was already scheduled to retire on Dec. 20 and that Gnosis Pay did not disclose how many customers were affected or what data was taken, though it emailed each affected customer with account-specific details.
The Block and Decrypt said Gnosis Pay has made 3D Secure mandatory for all online card payments until the consumer system is retired, reported the breach to partners, its card issuer and data-protection authorities, and warned customers about phishing and sharing addresses or crypto holdings.
Updates
- Update, : Update (Nov. 6, 3pm): Cointelegraph, citing breach notifications it reviewed, said exposed data included full payment card numbers, expiration dates, CVV codes, names, home addresses, linked crypto wallet addresses, emails, phones, nationalities and in some cases IBAN/BIC banking details; one notice said the customer's card was canceled Nov. 3 with no suspicious transactions. Cointelegraph also cited OpenRate figures of roughly 2,400 daily active Gnosis Pay cardholders and about $263,200 in prior-24-hour card volume; the company still has not disclosed how many customers were affected.
- Update, : Update (Nov. 7): CoinDesk reported that Rotki founder Lefteris Karapetsas posted the breach email he received on X, saying the exposed data included his name, full home address, card number and every wallet address linked to his account, which CoinDesk said raises the risk of targeted scams. CoinDesk also noted a June exploit that drained about $1.5 million through a wallet software flaw, which Gnosis covered, and cited Paymentscan data putting Gnosis Pay’s annualized payment volume at around $67.6 million. Gnosis Pay still has not said how many customers were affected.
Key facts
- Decrypt / The Block: unauthorized access detected Nov. 3 on the system behind Gnosis Pay-branded cards; contained within about two hours; funds unaffected.
- Decrypt: consumer (B2C) platform already set to retire Dec. 20; enterprise white-label platform not affected; company did not say how many customers or what data fields were exposed.
- The Block / Decrypt: 3D Secure is now mandatory for online card payments until the affected system is retired Dec. 20.
- Decrypt: Gnosis Pay said it reported the breach to partners, its card issuer and data-protection authorities and is arranging specialist monitoring for misuse of the data.