Gnosis Pay discloses customer data breach; branded cards set to close in December 2026
Gnosis Pay says unauthorized access affected the legacy consumer system that supports its branded payment cards. The company says customer funds were safe, but has not disclosed how many customers were affected or provided a complete list of exposed data.
- Gnosis Pay detected the intrusion on Nov. 3, 2026, and says it began containment within two hours.
- The company says its enterprise platform was not affected and customer funds remained safe.
- Branded card services are scheduled to end at 23:59 UTC on Dec. 20, 2026. The company announced the shutdown before the breach.
- A separate smart-contract exploit in June 2026 involved digital assets. Gnosis Pay has not linked the incidents.
What Gnosis Pay says happened
In a disclosure on Nov. 6, 2026, Gnosis Pay said unauthorized access affected its consumer business, the legacy system used to operate Gnosis Pay-branded cards. The company said its enterprise platform, which powers card programs under other businesses’ brands, was not affected.
Gnosis Pay says it detected the intrusion on Nov. 3 and began containment within two hours. It says it replaced affected security credentials, fixed the vulnerability and emailed each affected customer details about what had been taken from their account.
The public disclosure does not say how many customers were affected or provide a complete list of exposed information. Customers are therefore still without a clear public picture of the breach’s scale or the specific risks they may face.
Gnosis Pay says customer funds were unaffected. It also says it arranged specialist monitoring for possible misuse of exposed information and stepped up monitoring of card activity and wallets for fraud or attempts to access funds. The company has not said publicly who can use the specialist monitoring or how long it will last.
The company says it reported the breach to its partners and is communicating with applicable data protection authorities and its card issuer. It has not said publicly whether anyone has misused the exposed information.
How customers can reduce phishing risk
Gnosis Pay warned that suspicious messages could include genuine personal details or mention an actual purchase. That can make a scam harder to spot. Customers should treat unexpected emails, texts and calls with caution, even when the details appear accurate.
The company advises customers not to follow links in unexpected messages. Instead, open the official web app or partner app directly. Gnosis Pay says neither it nor its partners will ask for seed phrases, private keys, PINs or full card numbers, request identity re-verification by email or text, or tell customers to move funds through a message or call.
A seed phrase or private key can give someone control over crypto assets. No legitimate support agent needs either. Gnosis Pay says customers with concerns can contact [email protected], and that support is prioritizing people directly affected.
Gnosis Pay also made 3D Secure mandatory for all online card payments while the consumer system remains active. 3D Secure adds an extra verification step at checkout. The company says these safeguards will stay in place until the system is retired on Dec. 20, 2026.
The card shutdown predates the breach
Gnosis Pay announced the end of its branded card service before disclosing the breach. A formal notice dated Sept. 21, 2026, sets the closure for 23:59 UTC on Dec. 20, 2026. The company has not said the shutdown is a result of the breach.
When the service closes, physical and virtual cards will stop authorizing transactions. Customers who want continued card access must join a partner program under new terms. Joining is optional, but existing Gnosis Pay-branded cards will stop working either way.
The closure notice says the web app will retain withdrawal functionality and customers will continue to own assets held in their self-custodial Safe accounts. Self-custody means customers retain control of those assets. Losing card access does not itself affect ownership.
Cardholders are asked to export transaction histories and update recurring payments before the shutdown. General cardholder support is scheduled to end on June 18, 2027. Support for refunds, disputes and chargebacks is scheduled to continue until June 12, 2028.
The June exploit was a separate incident
Gnosis Pay also disclosed a smart-contract exploit that began on June 1, 2026. In its postmortem, the company attributed the vulnerability to Zodiac’s Delay Module and Roles Module, components used in its card Safe infrastructure. The postmortem says a flaw in signature validation allowed attackers to queue withdrawals from accounts they did not own.
Gnosis Pay reported that attackers extracted approximately $1.5 million. It also reported roughly $300, 000 in funds held in inaccessible accounts, bringing the total across 5, 281 wallets with balances of at least $1 to about $1.8 million. The 5, 281 figure refers to wallets involved in the June exploit, not customers affected by the November data breach.
The company said it absorbed the losses, restored users’ funds and that no users lost funds. Its postmortem also said it was exploring recovery options for the approximately $300, 000 in inaccessible accounts. It does not establish how much of that amount was later recovered from attackers rather than covered by Gnosis Pay.
The incidents involved different risks. The June exploit affected smart-contract wallets and digital assets, while the November disclosure concerns unauthorized access to the consumer system and possible exposure of personal information. Gnosis Pay has not said they shared a cause.
Questions customers are asking
-
Were customer funds affected by the November breach?
Gnosis Pay says they were not. It has not said publicly whether anyone has misused exposed information.
-
How many customers were affected, and what data was exposed?
The company has not published a customer count or a complete list of exposed data types. It says affected customers were emailed details about their own accounts.
-
When will Gnosis Pay-branded cards stop working?
At 23:59 UTC on Dec. 20, 2026. Customers who want continued card access must join a partner program under new terms.
-
Are the November breach and June exploit connected?
Gnosis Pay has not linked them. The company describes the June incident as a smart-contract vulnerability and the November event as unauthorized access to the legacy consumer system.
The main unanswered questions are how many customers were affected, what types of information were exposed and whether anyone has misused it. Gnosis Pay says it has notified partners and is communicating with relevant data protection authorities and its card issuer. A fuller public account of the breach’s scope has not yet been provided.
