Gnosis Pay, the crypto debit card company that lets people spend stablecoins through a Visa-linked card, says hackers broke into the legacy system behind its consumer cards on November 3 and walked away with customers’ home addresses, card numbers and a full list of every crypto wallet tied to their accounts. The company says it caught the intrusion fast and no money was taken, but at least one affected user says the leak handed scammers everything they’d need to target him directly, right down to his wallet history.
Gnosis Pay built its business on a simple pitch: let people spend the crypto sitting in their self-custody wallets the same way they’d spend money from a regular bank account, using a Visa debit card tied directly to that wallet. No need to cash out through an exchange first. That pitch found a real audience among DeFi users who wanted a bridge between on-chain holdings and everyday purchases, and the company built a sizable business processing card payments on top of it. It’s also exactly why this breach stings more than a typical retailer leak. The data that got exposed doesn’t just identify a customer. It maps that customer directly onto their crypto holdings.
Gnosis Pay disclosed the breach on November 3 and told customers it detected unauthorized access to the system powering its branded B2C cards, then started containing it within about two hours. The company says it has since replaced the affected security credentials and patched whatever let the intruder in, though it hasn’t said publicly what that flaw actually was.
What got exposed depends on who you ask. In the email Gnosis Pay sent to affected users, the company described the leaked data narrowly: the name printed on a customer’s card, their shipping address and their Gnosis Pay account reference number. CoinDesk’s reporting paints a wider picture, describing exposed data that included home addresses, full card numbers and the crypto wallets linked to each account.
Lefteris Karapetsas, the founder of the crypto portfolio tracker Rotki, posted on X that the breach notice he received listed his full name, home address, card number and every wallet address tied to his Gnosis Pay account. “You had already lost me as a user but you could have at least protected my data,” he wrote. That combination, a real address and a payment card number sitting next to a complete map of someone’s crypto holdings, is the part security researchers tend to flag as the real danger here. It’s not just a leaked email and password. It’s enough for a scammer to build a convincing, personalized pitch, or worse, to know exactly which doors to knock on.
That last part isn’t hypothetical in crypto. Wealthy wallet holders have been targeted with SIM swaps, fake support calls and even physical home invasions once attackers figure out who holds meaningful crypto balances and where they live. Pairing a confirmed home address with proof of a crypto wallet and the exact card tied to it hands that kind of attacker a head start they wouldn’t otherwise get. Security researchers have warned about this exact scenario for years as crypto debit cards grew more popular: the moment a financial product links a person’s legal identity to their on-chain holdings, any breach of that product becomes a physical safety issue, not just a privacy one.
Gnosis Pay says customer funds were never at risk, and that the breach didn’t touch the separate enterprise platform it runs for partner card programs. In response, the company has made 3D Secure verification mandatory for online card payments and stepped up fraud monitoring. The timing is notable: Gnosis Pay had already planned to shut the legacy consumer card system down entirely on December 20 as it shifts focus to white-label card programs for other businesses, so this breach hit a product that was already on its way out the door.
This isn’t Gnosis Pay’s first rough year. Back in June, a separate flaw in its wallet software let an attacker drain roughly $1.5 million from users, and the company covered those losses out of pocket to make customers whole. Two incidents in five months on a product it was already planning to retire is not a great look, even if neither one drained anyone’s crypto this time.
The breach also lands at a particularly bad moment for crypto security generally. The industry is still digging out from Binance’s record-setting hack in late October, a breach north of $6 billion that we’ve been tracking as new details emerge, including the company’s own root-cause report and a follow-up on how hackers moved the stolen funds through tracked wallets. Binance later said the attackers used a fake job interview and an internal AI tool to get in, and Binance founder Changpeng Zhao has since called for an industry-wide security alliance, arguing that exchanges and card providers need to share threat intelligence and coordinate responses rather than each quietly handling breaches on its own, since he believes AI-driven attacks are accelerating faster than any single company can track alone. Gnosis Pay’s breach is smaller in scale and didn’t touch funds directly, but it’s one more data point in a year where crypto platforms keep getting caught with security that hasn’t kept pace with how much personal and financial data they’re now sitting on.
Gnosis Pay has not said how many customers were affected, and it didn’t immediately respond to a request for comment from crypto outlet Protos. The company is reportedly notifying impacted users individually by email rather than issuing a blanket public disclosure with hard numbers, which makes it hard for outsiders to judge how big this actually is. For a company processing an estimated $67.6 million a year in card payment volume, even a breach limited to the legacy consumer line could touch a meaningful slice of its user base.
The bottom line
Encrypting a card number is table stakes. Linking that same card to every wallet address a customer owns, inside a system the company already knew it was retiring, is the kind of oversight that should have been caught in a basic security review long before anyone had to send out a breach notice. Gnosis Pay did the right things after the fact: fast containment, mandatory 3D Secure, covering the June losses. But moving fast once you get caught isn’t a security program, and crypto card providers holding this much personal data next to wallet graphs need to start treating that combination as the crown jewel it is, not an afterthought.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
