Gnosis Pay consumer card system suffered unauthorized access: customer names, addresses, and wallet addresses leaked

Gnosis Pay disclosed on November 6, 2026, that its consumer card system was accessed without authorization on November 3, resulting in the exposure of some customer information. The company stated that it initiated containment within two hours of discovering the incident and has replaced the affected credentials and fixed the vulnerabilities; customer funds were not affected.

This incident only involved the Gnosis Pay brand consumer card business, and the enterprise platform supporting white-label payment projects was not affected. Rotki founder Lefteris Karapetsas stated that the leaked information included his full name, address, card number, and the cryptocurrency wallet address associated with the account; the number of affected customers and the full scope of information have not yet been disclosed.

Gnosis Pay has enabled mandatory 3D Secure verification for online card transactions and strengthened monitoring of suspicious card and wallet activities; these measures will continue until the consumer card system is scheduled to be retired on December 20. The company stated that it has notified partners, issuing institutions, and relevant data protection agencies and will conduct a security review.