Gnosis Pay disclosed on November 6 that unauthorized access to its legacy consumer card system had exposed certain customer information. The company stated that customer funds were not affected and that the intrusion was limited to the platform powering its own branded payment cards.

Security monitoring systems detected the unauthorized access on November 3. Containment measures began within two hours. Gnosis Pay subsequently replaced affected security credentials and addressed the underlying vulnerability.

Scope Limited to Consumer Platform

The breach involved only the legacy system used for Gnosis Pay-branded consumer cards. The company’s enterprise white-label platform, which supports card programs for other businesses, was not affected.

Gnosis Pay notified its partners and said it was in contact with relevant data protection authorities and its card issuer. Monavate Limited, the issuer regulated by the UK Financial Conduct Authority, continues to operate.

The company did not disclose the number of customers affected or the specific categories of information exposed in its public statement. Instead, it sent individual emails on November 6 to every affected cardholder. Those messages detailed the information taken from each account and provided account-specific recommendations. Support staff are prioritizing responses to those customers.

Additional Security Measures Introduced

Gnosis Pay has made 3D Secure verification mandatory for every online card payment. The requirement will remain in place until the consumer platform is retired. Card transactions and associated wallets are also under closer monitoring for signs of fraud or attempts to access funds.

A full internal review is underway. Lessons from the incident are being applied across systems, and specialist monitoring has been arranged to detect any misuse of the exposed information.

Customer Guidance on Phishing Risks

The company advised cardholders to access its official web application or partner applications directly rather than clicking links in unsolicited messages. It warned that fraudulent communications might include accurate personal details or references to genuine purchases.

Customers were told that neither Gnosis Pay nor its partners would ever request seed phrases, private keys, PINs or full card numbers. The firm said it would not ask users to re-verify identity through email or text, nor instruct them to send funds based on a message or call. Anyone with concerns was directed to contact the company’s support address.

The guidance also cautioned against sharing residential addresses or details of crypto holdings, both online and offline, given the risk of physical threats targeting cryptocurrency users.

Consumer Service Already Scheduled for Closure

The retirement of the consumer platform was announced on September 21, well before the November incident. Branded card services are set to end at 23:59 UTC on December 20, 2026. At that point, transaction authorization will cease for both physical and virtual cards.

Withdrawal functionality will remain available through the web application. Customers will retain ownership of assets held in their self-custodial Safe accounts. Those who wish to continue using a card after the shutdown must enroll in a partner program under revised terms; the step is optional because existing branded cards will become inoperative regardless.

Cardholders have been instructed to download their transaction records and update any recurring merchant payments before the closure. Standard cardholder support is scheduled to conclude on June 18, 2027. Assistance for refunds, disputes and chargebacks will remain available through June 12, 2028.

Earlier Security Incident

The November disclosure follows a separate incident in June in which roughly $1.5 million in digital assets was compromised through a card-account exploit. A July postmortem attributed that event to a vulnerability in the Zodiac smart contract framework. Gnosis Pay stated that affected customers were fully reimbursed. The company has not indicated that the two incidents share a common cause.

Additional payment checks and enhanced monitoring will remain active on the consumer system until its planned December retirement.