Gnosis Pay, a cryptocurrency debit card provider, has disclosed a security breach that exposed sensitive customer information, including names, full home addresses, card numbers, and cryptocurrency wallet addresses linked to user accounts. The incident raises serious privacy and security concerns because it could allow attackers to connect customers’ real-world identities with their crypto holdings, potentially making them targets for phishing, identity theft, and tailored financial scams.
Lefteris Karapetsas, founder of crypto portfolio tracker Rotki, revealed details of the incident in a post on X after sharing an email he received from Gnosis Pay. He said the exposed information included his name, full residential address, card number, and every wallet address connected to his account. Criticizing the company’s handling of customer data, Karapetsas wrote: "You had already lost me as a user but you could have at least protected my data."
Launched in 2023, Gnosis Pay enables users to spend stablecoins through Visa debit cards connected to their cryptocurrency wallets. Paymentscan data puts the platform’s annualized payment volume at approximately $67.6 million, highlighting the scale of the service involved.
Gnosis Pay said it detected the intrusion on November 3 and began containment measures within two hours. The company reported that it replaced affected security credentials and fixed the vulnerability that enabled the breach. It also stated that customer funds were not compromised and that its separate enterprise platform, which supports card programs operated by other businesses, was unaffected.
The company has not disclosed how many customers were impacted. Instead, it said it contacted each affected user by email to explain which categories of personal information had been exposed. This leaves the overall scale of the incident unclear.
The breach comes months after another security incident in June, when an exploit involving a wallet software vulnerability resulted in approximately $1.5 million in losses. Gnosis covered the losses and restored customer funds. Since then, the company has introduced mandatory 3D Secure verification for online card payments and expanded fraud monitoring. It has also announced plans to shut down its legacy consumer system on December 20.
Gnosis Pay has warned that criminals could exploit the stolen information alongside details of previous purchases to create convincing fraudulent messages. The combination of residential addresses, payment card details, and linked wallet addresses makes the incident particularly sensitive: attackers may be able to target individuals with scams tailored to their identities and financial activity. Although the company says customer funds remain safe, the exposure of personal and wallet data creates risks that may persist beyond the technical containment of the breach.
