Gnosis Pay detected unauthorised access on 3 November 2026 to the legacy system behind its Gnosis Pay-branded B2C cards. Funds were not affected and its enterprise white-label platform was not affected.

An affected customer posted their breach email listed: name, shipping address, Gnosis Pay account reference, and card-order information that can identify the linked wallet, allowing name and physical address to be connected to wallet balance and history.

The same notice said card numbers, CVVs and PINs were not exposed and no funds moved. Gnosis Pay said every affected customer was emailed 6 November with their exact exposed fields, and advised vigilance against phishing using real details, never sharing seed phrase, keys, PIN or full card number. Claims in Telegram forwards of full card numbers with CVV do not match the customer email posted so far.