Crypto card provider Gnosis Pay says hackers gained access to some customer information through the older system that runs its own branded cards.
The company said its monitoring systems spotted the unauthorised access on 3 November, and that it began containing it within two hours. It has since replaced the compromised security credentials and fixed the weakness that was used.
“While funds were not affected, the security of personal information is just as important and we take full responsibility,” Gnosis Pay said on X. “We deeply regret that this happened.”
What was exposed
Gnosis Pay had not said what type of data was taken or how many customers were affected at the time of writing. It said it has emailed each affected customer with details of what was accessed from their account.
The breach was limited to the company’s consumer card platform, which was already due to close on 20 December. Its business platform, which runs white-label card programmes for fintech firms, wallets and digital banks, was not affected.
How Gnosis Pay is responding
The company says it has stepped up fraud monitoring on cards and wallets, and has made 3D Secure, an extra verification step, mandatory for all online card payments until the consumer platform closes.
It has reported the breach to its partners, its card issuer and data protection authorities, and is arranging specialist monitoring for signs that the stolen data is being misused.
Gnosis Pay’s advice to customers
Gnosis Pay has told customers to be wary of unexpected messages about their cards, even if those messages include real personal details or genuine purchases. The company says it will never ask for seed phrases, PINs or full card numbers, and will never ask users to move their funds.
It has also advised customers to be careful about sharing their address or details of their crypto holdings, online or in person.
That warning reflects a wider risk. Blockchain analytics firm Chainalysis reported more than $30 million stolen in physical “wrench attacks” on crypto holders in the first half of 2026, where criminals use force or threats in person.
What happens next
Customers will be watching for more detail on what data was taken and how many people were affected. The consumer card platform is set to close on 20 December as planned.
