Gnosis Pay Hacked: Card Numbers, CVVs and Home Addresses Exposed — 7 Things Every Crypto Card Holder Must Do Now

Hackers got inside Gnosis Pay's crypto card system on November 3 and walked away with customer data that included full card numbers, CVV codes and home addresses. The company says your crypto funds were not touched — but the information needed to impersonate you, drain your card and phish your wallet is now in criminal hands. If you hold a Gnosis Pay card, or any crypto debit card, here are the 7 steps to take today.

Gnosis Pay confirmed the breach on November 6, three days after its monitoring systems detected unauthorised access. It is the latest security incident in a brutal week for crypto holders, and it carries a lesson that goes far beyond one card provider: when a crypto card is breached, the danger is not the money on the card — it is everything the card knows about you.

What Happened: The Gnosis Pay Breach in 5 Numbers

The facts, as disclosed by Gnosis Pay in its official breach notice and reported by Decrypt, are straightforward — and the gaps in them are the story.

November 3, 2026: Gnosis Pay's monitoring systems detect unauthorised access to the system powering its own branded cards. Containment begins within two hours, compromised security credentials are replaced, and the vulnerability is addressed. What the company has not said is how the attackers got in, or who they were.

November 6, 2026: Three days later, Gnosis Pay discloses the breach publicly, emails every affected customer with exactly what was taken from their account, notifies its partners, and says it is communicating with data protection authorities and its card issuer.

2 hours: The time between detection and the start of containment. That is a fast response by industry standards — and it still was not fast enough to stop the data from being viewed.

December 20, 2026: The date the affected system was already scheduled to be retired. Gnosis Pay's consumer card business was set to shut down weeks before the breach happened, which raises an uncomfortable question: how much security investment was going into a system with 47 days left to live?

0: The number of affected customers Gnosis Pay has publicly disclosed. The company has not said how many people were hit, and it has not published a list of the data types exposed. Each affected customer was told privately what was taken from their account.

What Was Actually Exposed — And Why "Funds Safe" Misses the Point

Gnosis Pay's public statement says only that "certain customer information" was exposed. That careful phrasing hides the real damage. Reporting on the customer notifications reviewed by Cointelegraph paints a far more serious picture: full payment card numbers, expiry dates, CVV security codes, names, home addresses, linked crypto wallet addresses, email addresses, phone numbers and nationalities — with IBAN and BIC bank details in some cases.

That is not a partial leak. That is a complete identity kit. Here is what each exposed data type lets a criminal do:

Data exposed	What criminals can do with it	How fast it can hurt you
Full card number + expiry + CVV	Make online purchases in your name until the card is cancelled	Minutes — carding bots test stolen cards automatically
Home address + full name	Identity theft, SIM-swap setup, physical targeting of known crypto holders	Days to weeks
Linked wallet addresses	Track your on-chain wealth, target you with tailored phishing and dusting attacks	Immediately — wallet addresses are public forever
Email + phone number	Phishing emails and SMS that reference your real card and real wallet	Days — expect them within a week
IBAN / BIC (some accounts)	Direct-debit fraud attempts and bank impersonation calls	Days to weeks

The wallet-address link is the part most people underestimate. A stolen card number can be cancelled. A wallet address cannot be changed without moving your funds, and once criminals know which wallets belong to a verified crypto card holder, you are on a permanent target list. Your on-chain balance is visible to anyone who looks it up.

That is why "funds were not affected" — Gnosis Pay's headline reassurance — is technically true and practically misleading. The funds on the card were not drained in this incident. But the data that lets criminals drain your accounts, impersonate you to your bank, and phish your seed phrase is now circulating. The theft in a breach like this is often not the event itself; it is what happens in the weeks after it.

The 3-Day Gap: Detected November 3, Disclosed November 6

Gnosis Pay detected the intrusion on November 3 and told the public on November 6. Three days is not unusual in breach disclosure — companies need time to contain, investigate and notify — but those three days matter when full card details are involved, because stolen card data is typically tested and sold within hours.

What we know about the timeline:

• September 21, 2026: Gnosis Pay formally announces the retirement of its branded consumer card service, effective December 20, 2026.
• November 3, 2026: Unauthorised access detected on the legacy consumer card system; containment begins within two hours.
• November 6, 2026: Affected customers emailed with details of what was taken; public disclosure published; partners, data protection authorities and the card issuer notified.
• November 6, 2026: Mandatory 3D Secure verification switched on for all online card payments, in force until the system retires.
• December 20, 2026: The consumer card system is retired as planned; Gnosis Pay-branded cards stop working.

The company says it replaced the compromised credentials and fixed the vulnerability, and that it has stepped up monitoring of card activity and wallets for fraud. It has not published a technical root-cause explanation, and it has not said whether the attackers are still being investigated by law enforcement.

Who Is Affected — And Who Is Not

The breach was limited to the legacy system behind Gnosis Pay-branded cards — the company's direct-to-consumer business. Its enterprise platform, which powers white-label card programmes for fintech firms, wallets and neobanks, was not affected, according to the company.

That distinction matters. If you use a crypto card issued through a partner app that runs on Gnosis Pay's enterprise platform, the company says you are not affected. If you hold a card with Gnosis Pay's own branding, you should assume you are affected until you hear otherwise — and act now rather than waiting for the email.

The cards are issued by Monavate Limited under a licence from Visa Europe, which means the usual Visa card-scheme protections apply, but those protections do not cover the non-card data — your address, your wallet, your phone number — that was exposed alongside it.

The 7-Step Protection Checklist: Do These Today

Do not wait for the phishing emails to arrive. Work through this checklist in order — it takes under an hour and closes the most dangerous gaps first.

Step 1 — Freeze or cancel the card immediately. Do not wait for a fraudulent charge to appear. Contact Gnosis Pay or your card issuer and cancel the exposed card. A replacement card number breaks every automated carding attempt at once. This is the single highest-value action you can take.

Step 2 — Move funds off any wallet linked to the card. Your linked wallet addresses are now associated with your name, address and phone number. Move holdings to a fresh wallet with a new address, and never link the new wallet to a card or service that holds your identity documents. Your crypto itself was not stolen — keep it that way by breaking the link.

Step 3 — Turn on every alert your bank offers. Enable transaction notifications, login alerts and new-payee warnings on every bank account connected to the card, including any account whose IBAN may have been exposed. Stolen card data is usually tested with small transactions first — a £1 or $1 charge is the warning shot, not a glitch.

Step 4 — Assume every "Gnosis Pay" email is fake until proven otherwise. Gnosis Pay says it will never ask for your PIN or seed phrase, or ask you to move funds. Any email, text or call that does is a scam. Do not click links in breach-related emails. If you need to contact the company, type [email protected] into your mail app yourself — never reply to a message that arrived claiming to be from them.

Step 5 — Change passwords and enable two-factor authentication everywhere the exposed email was used. Your email address and phone number are now paired with the knowledge that you hold crypto. Reuse of the same password across your email, exchange and banking accounts turns a card breach into a full account takeover. Use a password manager and hardware-key or authenticator-app 2FA, not SMS codes — your phone number is part of what leaked.

Step 6 — Watch for SIM-swap attempts. With your name, address, phone number and date-linked identity data exposed, criminals have much of what a mobile carrier asks for to port your number. Call your carrier, add a port-out PIN or account password, and ask what extra verification they require before any SIM change. Losing your phone number means losing SMS-based 2FA everywhere at once.

Step 7 — Check your credit and set a fraud alert. File a fraud alert with your credit bureau and review your credit report for accounts you did not open. Full name, home address, phone number and banking details are enough to attempt identity theft, and the damage from that surfaces months later, not days.

The Phishing Wave Is Coming: 5 Red Flags to Watch For

Every major crypto data breach is followed by a wave of phishing that uses the stolen data to look legitimate. Expect messages that mention your real card, your real wallet address and your real name. That is what makes this breach dangerous — the phishing will not look generic.

• Urgent "verify your card" emails that link to a login page: Real companies do not ask you to verify a breached card by clicking a link. Go to the official site yourself or ignore it.
• Messages claiming your funds are at risk and you must "move them to a safe wallet": This is the oldest crypto scam in the book, and it works best right after a breach. Gnosis Pay explicitly says it will never ask you to move funds.
• Fake support calls referencing your card number or wallet: Criminals will quote the first digits of your card or your wallet address to prove they are "from Gnosis Pay". A real support agent will never ask for your PIN, seed phrase or full card details.
• "Compensation" or "refund" offers for affected customers: There is no compensation programme. Any offer of a refund in exchange for connecting your wallet is a drainer scam.
• Lookalike domains and apps: Expect fake Gnosis Pay apps, fake "breach check" websites and social media accounts offering to check whether you were affected. Only trust the company's own published channels.

The pattern is well established: the breach is the setup, the phishing is the payoff. The attackers who buy this data are not the same people who stole it, and they will work it for months.

Why Crypto Cards Keep Getting Hit

Gnosis Pay is not an isolated case. In June 2026, a separate card-account exploit involving Gnosis Pay was reported to have drained about $1.5 million in digital assets. This week alone, the industry is still tracing the $6.43 billion Binance hack, with billions in stolen funds moving through exchanges and mixers — read our tracker on where the Binance hack money is now.

Crypto cards sit at a uniquely exposed intersection. They connect three things criminals want: a payment card, a verified identity, and a crypto wallet. A normal bank card breach exposes spending power. A crypto card breach exposes spending power plus proof that the victim holds crypto — and the wallet address to prove how much. That combination makes card holders higher-value targets than ordinary banking customers, and it makes the data worth more on criminal markets.

What Most People Get Wrong About "Funds Were Not Affected"

The most dangerous sentence in Gnosis Pay's disclosure is the most reassuring one. "Funds were not affected" is true — and it is the sentence most customers will remember. It creates exactly the wrong incentive: to do nothing.

Here is what that sentence does not mean. It does not mean your money is safe — it means it was not stolen in this specific incident. It does not mean your card is safe to keep using — the card number, expiry and CVV are compromised and must be replaced. It does not mean your identity is safe — the data needed to impersonate you is out there. And it does not mean the incident is over — the consequences of a data breach arrive weeks and months later, in the form of phishing, identity theft and targeted attacks.

There is a second myth worth killing: that a breached card is a small problem because you can just get a new one. A new card fixes the card. It does not fix the wallet address now linked to your home address, the phone number now paired with your crypto holdings, or the email address now flagged as belonging to a crypto holder. Those links are permanent, and the only fix is to break them — new wallet, new security habits, and a hard look at which services hold your identity.

If you are choosing a replacement card, compare the options properly first — our comparison of the best crypto debit cards in 2026 covers fees, limits and security features. And if you are rethinking how you buy and hold crypto at all, our guide to buying Bitcoin with PayPal walks through a route that keeps your bank details away from crypto-native services entirely.

What Happens Next

Three dates decide what happens next for Gnosis Pay customers. On December 20, 2026, the consumer card system retires and Gnosis Pay-branded cards stop working — if you still hold one, spend or move the balance before then and do not rely on the card after that date. Before that, mandatory 3D Secure verification stays in force for all online card payments, which adds friction but also blocks the easiest form of card fraud. And in the weeks after the disclosure, expect the phishing wave: data protection authorities have been notified, but enforcement moves slowly while criminals move fast.

The wider market context does not help. Bitcoin is trading near $75,800, about 40% below its October 2025 all-time high, and the Crypto Fear & Greed Index sits at 25 — extreme fear — after a week of ETF outflows and a $1.27 billion liquidation wave. Fearful markets are exactly when phishing works best: people are anxious, checking their accounts constantly, and far more likely to click a message that promises their funds are at risk. For the price outlook, see our Bitcoin price prediction for November 2026.

For the industry, the Gnosis Pay breach is another data point in a pattern that regulators are now watching closely: crypto services that collect full identity data and then underinvest in protecting it. The company's enterprise platform was untouched, which suggests the security gap was specific to the legacy consumer system — but that is cold comfort to the customers whose data was in it.

Frequently Asked Questions

Was my money stolen in the Gnosis Pay breach?

No — according to Gnosis Pay, customer funds were not affected. The breach exposed customer information, not crypto holdings. But the exposed data includes full card numbers, CVVs and wallet addresses, so the risk now is fraud and phishing using that data, not a direct theft from the breach itself.

How do I know if I was affected by the Gnosis Pay hack?

Gnosis Pay emailed every affected customer on November 6 with exactly what information was taken from their account. If you hold or held a Gnosis Pay-branded card and did not receive an email, do not assume you are safe — check your spam folder, and contact the company directly at [email protected] (typed in by hand, not via a link) if you are unsure.

Should I cancel my Gnosis Pay card?

Yes. If your card details were in the breached system, the card number, expiry date and CVV should be treated as compromised. Cancel the card and request a replacement, and move any crypto from wallets linked to the card to a fresh wallet address.

Is my crypto wallet at risk after the Gnosis Pay breach?

Your wallet itself was not hacked — the breach exposed wallet addresses, not private keys or seed phrases. But criminals now know which wallets belong to verified crypto holders, which makes you a target for phishing and social engineering. Never share your seed phrase with anyone, and move funds to a new address if your old one is linked to your identity.

What is 3D Secure, and why did Gnosis Pay make it mandatory?

3D Secure is the extra verification step (usually a code from your bank or banking app) required to approve an online card payment. Gnosis Pay made it mandatory for all online payments until the consumer system retires on December 20, 2026, to block criminals from using the stolen card details for online purchases.

Are other crypto cards safe to use?

No card is risk-free, but the risk varies sharply by provider. Choose cards from providers with strong security track records, enable transaction alerts, never link a card to your main long-term wallet, and keep only spending money on card-linked wallets. Compare providers in our best crypto debit cards 2026 comparison.

Conclusion

The Gnosis Pay breach is a reminder that in crypto, the most valuable thing a company holds about you is often not your money — it is your identity. Hackers got full card numbers, CVVs, home addresses and wallet addresses from a system that was weeks away from retirement. The funds survived. The data did not, and data is what the next wave of attacks will be built on.

If you hold a Gnosis Pay card, cancel it, move your crypto to a fresh wallet, lock down your phone number and bank accounts, and treat every breach-related message as hostile until proven otherwise. The seven steps above take less than an hour. The identity theft they prevent can take years to undo. Do them today — before the phishing wave arrives, not after it.