Gnosis Pay Reports Data Breach, Adds 3D Secure Until Dec. 20

Gnosis Pay said hackers reached customer information through the legacy system that powers its own branded payment cards, an intrusion it disclosed on Nov. 6, 2026, and first detected on Nov. 3. According to crypto.news, the company said no customer funds were affected, and it has made an extra verification step compulsory for online purchases until the consumer platform shuts down on Dec. 20.

The disclosure, published on Gnosis Pay’s blog, covers the business line that issues Gnosis Pay-branded cards. The separate enterprise platform, which runs white-label card programs for fintech firms, wallets and neobanks, was not part of the incident, Decrypt reported.

Also readCrypto Card Payments Hit Record $12.5 Billion, Up 140% in 2026

Response and customer concerns

In a post on X, Gnosis Pay said the breach affected the system behind its branded cards and exposed certain customer information, adding that it deeply regretted the incident. In the same thread, the company wrote that funds were not affected but that protecting personal information carries equal weight and that it takes full responsibility, as quoted by Decrypt.

The replies were skeptical. crypto.news reported that one user, posting as Zoodirektor, questioned what taking full responsibility would actually mean, while another, using the handle dramanoodle, warned of more fraudulent emails and physical attacks on crypto holders. Gnosis Pay has said it reported the incident to partners, its card issuer and applicable data protection authorities, and is lining up specialist monitoring for misuse of the exposed data. Card activity and wallets are under closer fraud surveillance.

Also readLopp: AI Bug Finding Pushes Bitcoin Core Security Shift

Its guidance tells customers to distrust unexpected messages about their cards, even ones containing real personal details or a genuine-looking purchase. The company said it and its partners would never ask for seed phrases, private keys, PINs or full card numbers, and would not push customers to move funds.

Why it matters

Anyone holding a Gnosis Pay-branded card is affected by the online verification change, but the breach is narrower than a full-platform compromise because the white-label enterprise business sits outside it. The timing is awkward: Gnosis Pay had already told cardholders to migrate to partner programs and export transaction histories before the shutdown. Blockonomi noted that records do not disappear at closure — its published data guidance keeps identity and transaction records for five years after account closure and support correspondence for six — and that blockchain explorers cannot substitute for a card-history export because they do not show merchant names.

Decrypt placed the incident in a run of crypto security failures, citing a record $6.4 billion hack of Binance, a breach at analytics vendor Amplitude that exposed some Coinbase customer contact data, and Ledger’s warning about a suspected $87 million drain tied to devices bought from a reseller. Decrypt also pointed to Chainalysis data showing physical “wrench attacks” were on course for a record year, with more than $30 million stolen in the first half of 2026. The November breach is distinct from a June card-account exploit of about $1.5 million that Gnosis Pay blamed on a Zodiac smart contract flaw and said it fully reimbursed; the company has not linked the two.

What to watch

The Dec. 20, 2026 shutdown is the next fixed point, when physical and virtual branded cards stop authorizing transactions, though the web app will keep withdrawal functions and self-custodial Safe account assets stay with customers. General cardholder support is scheduled to end June 18, 2027, with refunds, disputes and chargebacks handled until June 12, 2028. Separately, the scope of the exposed data may become clearer if regulators or the card issuer address it.

Sources: crypto.news, Decrypt, Blockonomi