On November 3rd, Gnosis Pay discovered that someone had gained unauthorized access to an old system used for early Gnosis Pay brand cards. The company subsequently confirmed that some customer data had been exposed, but the funds were not affected, and the corporate white-label card platform was not within the scope of this incident. On the surface, this seems like an event where "no money was lost"; however, for the affected users, the real risk may have just shifted from within the system to email, text messages, and payment verification processes.
This old system was originally scheduled to be decommissioned on December 20th. Gnosis Pay stated that after detecting the anomaly, actions were taken within two hours, including replacing credentials and fixing related vulnerabilities, and affected users were also notified. This incident highlights a common yet often underestimated security issue: even though the business has been migrated to a new platform, the old infrastructure still retains sufficient data and permissions, which could potentially serve as an entry point until it is officially taken offline.
No financial loss, but there is still a possibility of a next-hop attack.
The company did not disclose all the exposed fields in the announcement, but clearly warned users to be wary of phishing messages and not to share login credentials, wallet keys, or one-time verification codes via email, text messages, or social media. This advice reveals the subsequent pathways of data leakage. Attackers may not necessarily be able to transfer funds directly from the old system, but they can use identity information, card relationships, or brand trust to impersonate customer service and induce users to hand over control.
Gnosis Pay has enabled mandatory 3D Secure for online payments. 3DS adds cardholder verification during the transaction process, reducing the chances of online fraud using only card information. However, it is not a foolproof barrier: if users voluntarily submit verification codes on phishing pages, or if attackers take over other accounts through social engineering, the additional verification can also be bypassed. Therefore, both technical patches and user reminders are necessary.
The statement "funds are not affected" still needs to be understood in context. It means that as of the time of the announcement, no customer funds were found to have been damaged due to this intrusion. However, this does not imply that there are no costs associated with the leakage of personal data. Replacing cards, verifying transactions, identifying fraudulent information, and restoring trust will all fall on the users and the operations team. The losses from a security incident are not only reflected in the balance on the blockchain but also in the additional communication required over the coming weeks.
Systems scheduled for retirement still require active-duty-level defense.
The old platform will be decommissioned on December 20th, and this timeline actually exacerbates management issues. Once a system enters the end of its lifecycle, teams tend to reduce functional development, and users and business focus also shift to the new platform. However, the potential for attacks does not disappear automatically just because of an internal roadmap. As long as the old platform is still connected to the internet and retains credentials or customer data, it requires the same level of monitoring, access control, and patching discipline as the active systems.
Gnosis Pay indicates that the enterprise's white-label platform has not been affected, which delineates the product boundaries of this incident. It is the old system of the early brand cards that has been impacted; therefore, the leakage should not be exaggerated as if the entire Gnosis Pay infrastructure has been compromised. Conversely, just because the main platform remains unaffected does not mean that customers using the old system can be neglected. Clearly defining the scope is essential so that those who truly need to take action can do so, while also avoiding panic among unrelated users.
For users who have received notifications, the most practical actions to take are to verify their accounts through the official app or the saved website addresses, and not to click on the login links in the sudden messages; check recent transactions; and reject any requests for mnemonic phrases, private keys, passwords, or verification codes. If it is necessary to contact customer service, one should initiate the contact through official channels, rather than using the contact information provided in the emails. These measures are aimed at preventing secondary attacks that may result from data leaks, rather than dealing with confirmed cases of unauthorized transactions.
The company still needs to answer two verifiable questions later on: the precise scope of the affected fields, and when the data from the old system was completely deleted. Only with a clear understanding of the scope can users determine whether they need to replace their cards or monitor specific accounts; only if an auditable record is left during the decommissioning process can the outside world confirm that the entry point no longer exists. Once the patch fixes the vulnerabilities on that day, it will be determined whether similar risks will be carried over to the next time.
The incident has brought into sharp focus the distinction between "security of funds on the blockchain" and "security of account relationships." Even if a wallet's balance remains unchanged, attackers may still obtain enough information to carry out convincing scams. The company has already blocked the entry points and strengthened payment verification, but whether users are truly safe depends on how the old data is used. The real conclusion is not just to declare that funds are unharmed, but rather until the old system is completely phased out and affected users have passed the high-risk period of phishing attacks, all remaining entry points must also be closed.
