Gnosis Pay Breach: Wallet Funds and Personal Data Have Different Risks

Gnosis Pay says unauthorized access to its legacy consumer-card system did not affect funds. That assurance addresses one part of the incident. It does not tell an affected customer what personal information someone obtained or how that information might be used later.

The distinction matters for people choosing cryptocurrency services on the basis of self-custody. Control of a wallet key and control of records held by a card provider are separate questions.

The November disclosure

In its November 6, 2026 notice, Gnosis Pay said it detected unauthorized access on November 3. It said containment began within two hours, followed by credential replacement and a correction to the vulnerability. No independent investigation accompanied the notice.

The company limited the incident to its legacy Gnosis Pay branded-card system and said its enterprise platform was unaffected. It notified affected users individually about their exposed information. The public notice did not list every data field or provide a total number of affected people.

Gnosis Pay also said it introduced mandatory 3D Secure checks for online card payments and increased monitoring. The notice does not establish stolen wallet keys or a failure of blockchain cryptography.

Self-custody does not control a provider's database

The card closure notice issued September 21 describes the customer's Safe as a self-custodial account. It separately explains that the card and most web-app functions stop at 23:59 UTC on December 20, 2026, with withdrawal access continuing.

That retirement was already announced before the November breach. It should not be described as a shutdown ordered in response to this incident.

For a customer, the practical distinction is between authorizing a wallet transaction and using a payment service. A service can need identity, contact or account information without holding the key that authorizes every on-chain transfer. Whether a field was exposed here must come from the customer's notice or a later disclosure, rather than assumptions about what a card provider might collect.

Personal information can support convincing impersonation

Consider a hypothetical follow-up message that correctly names a service you use and asks you to reconnect a wallet to resolve a security problem. The familiar detail makes the message more plausible. It does not authenticate its sender.

A malicious request might ask for a seed phrase, a payment, a signature or access through an unfamiliar site. These are different operations with different consequences. Read the actual request rather than treating a security-themed message as permission to approve it.

That scenario is hypothetical. The notice does not establish that someone used exposed records to carry it out. Our KYC privacy guide explains why information collected by an intermediary remains a separate concern from a wallet's spending keys.

Steps for affected cardholders

Read the individual notification and record the exact categories it identifies. If the list is vague, ask support for specifics through the contact route you already use. Do not send documents or wallet secrets to a new address supplied by an unsolicited message.

Review account activity and report unfamiliar transactions through the established card-support process. Keep the notice and relevant correspondence. A blanket recommendation to replace every credential or card would go beyond the published evidence, so follow the instructions applicable to your account.

Plan separately for the scheduled card retirement. Export records needed for payments, refunds or disputes while the normal interface remains available. That administrative task should not be confused with responding to the breach.

Research checked November 9, 2026 UTC. The specific exposed fields, affected-person count and a complete public technical account remained unavailable in the notice reviewed.