A security breach at crypto-linked Visa debit card provider Gnosis Pay exposed payment card credentials, personal information and cryptocurrency wallet addresses, according to a Cointelegraph report published on Nov. 7, 2026, at 04:51:23 UTC+8.
Gnosis Pay disclosed the breach on Friday, saying it had detected unauthorized access to its legacy consumer card system on Nov. 3 and begun containment within two hours. The company said customer funds and its separate enterprise platform, which powers white-label card programs, were unaffected.
What information was exposed
According to breach notifications reviewed by Cointelegraph, the exposed data included:
- Full payment card numbers, expiration dates and CVV codes
- Customer names, home addresses and linked cryptocurrency wallet addresses
- Email addresses, phone numbers and nationalities
- In some cases, banking information, including IBAN and BIC details
One notification confirmed that the recipient’s card had been canceled on Nov. 3, with no suspicious transactions or movement of funds detected. That notification describes one customer’s account, not a comprehensive assessment of all affected accounts.
Security response and remaining uncertainty
Gnosis Pay said it replaced compromised security credentials, addressed the vulnerability and made 3D Secure verification mandatory for online payments until the legacy system’s planned retirement on Dec. 20. It also warned customers about phishing attempts using their personal or transaction details and said it was arranging monitoring for potential misuse of the stolen data.
The company did not disclose how many customers were affected and had not immediately responded to Cointelegraph’s request for comment at the time of the report.
Card activity is not a measure of breach exposure
Cointelegraph cited third-party crypto card activity tracker OpenRate as showing around 2,400 daily active Gnosis Pay cardholders and $263,200 in transactions over the preceding 24 hours.
Those figures provide a snapshot of card usage, not the number of people whose data was exposed. The report supplied no prior-period comparison, total cardholder base or retention data, so the figures do not establish growth or durable adoption. With the affected customer count undisclosed, they also cannot establish what share of cardholders was impacted.