Encryption card provider Gnosis Pay stated on Friday that hackers accessed customer information through the system behind their own brand of cards, which is the latest in a series of security incidents in the encryption industry.
Gnosis Pay stated in a blog post that its monitoring system detected unauthorized access on November 3rd and began to contain it within two hours. The company said that it has since replaced the affected security credentials and fixed the vulnerabilities. The company assured that customer funds were not affected.
This leak is limited to the consumer business of Gnosis Pay; this platform was originally scheduled to be decommissioned on December 20th. Its corporate platform, which provides white-label card project support for fintech companies, wallets, and new types of banks, was not affected.
Gnosis Pay does not specify how many customers were affected, nor does it mention what data was leaked. However, it states that an email has been sent to each affected customer, explaining which information was taken from their accounts.
"Although the funds have not been affected, the security of personal information is equally important, and we take full responsibility for this," the company wrote on X.
Gnosis Pay indicates that monitoring of card activities and wallets has been strengthened to prevent fraud, and before the consumer platform is decommissioned, an additional verification step known as 3D Secure will be made mandatory for all online card payments. The company has also reported this data breach to its partners, card-issuing institutions, and data protection authorities, and is arranging for professional monitoring to determine whether the data has been misused.
We experienced a data breach that affected the system supporting the Gnosis Pay brand cards (our B2C business line), resulting in the leakage of some customer information.
"All affected individuals have received an email containing complete information today."
We deeply regret this incident. Although the funds...
The company also urges customers to be wary of any unexpected messages regarding their cards, even if these messages contain genuine personal information or consumption records. The company states that it will never request users to provide mnemonics, the PIN code, or the full card number, nor will it ask users to transfer funds.
The company also reminds customers to be cautious about sharing their addresses or the status of their encrypted asset holdings, whether online or offline.
This final reminder reflects an increasingly growing threat. Blockchain analytics firm Chainalysis indicates that "wrench attacks" against cryptocurrency holders, including burglaries and kidnappings, are expected to set a record for the whole year after thefts exceeded $30 million in the first half of 2026.
This disclosure comes shortly after several other recent security breaches in the cryptocurrency industry. In addition to the record $6.4 billion hacker attack on the world's largest cryptocurrency exchange Binance, competitor trading platform Coinbase stated last week that a leak from analytics provider Amplitude exposed some customer contact information.
Last month, hardware wallet manufacturer Ledger stated that in a suspected $87 million fund loss incident, all confirmed cases involved devices purchased from Southeast Asian resellers CryptoBilis, and urged recent buyers to transfer their funds to new devices.
Daily Briefing Newsletter
Starting with the latest headlines every day, it also includes original features, podcasts, videos, and more.
Join 72,000 readers
