Gnosis Pay Breach Exposed Home Addresses, and Some Users Say Card Numbers Too

The Gnosis Pay breach has left an unknown number of stablecoin card customers with personal details in the hands of an unauthorised party, including home addresses. The company, which issues white-label stablecoin cards, says it detected unauthorised access on November 3 to the system behind its Gnosis Pay-branded cards, the consumer-facing (B2C) side of its business.

What the Gnosis Pay breach exposed

According to the notice sent to customers, the exposure was uneven. Some users were told that the affected data was their name as printed on the card, their shipping address and their Gnosis Pay account reference. That is a modest-sounding list, but a name paired with a physical address is exactly the kind of information that can be used for targeted phishing or other social-engineering attempts.

Others appear to have been hit harder. Lefteris Karapetsas, founder of the crypto portfolio tool Rotki, shared that his notification said the compromised information included his full home address, his name, his card number and every wallet address linked to his account. Linking wallet addresses to a real name and address matters in crypto, where on-chain activity is otherwise pseudonymous. Anyone holding that combination could connect a person’s identity to their public transaction history.

A system already on its way out

Gnosis Pay had already planned to retire the affected system at the end of this year. That timing offers little comfort to customers whose data has already been exposed, but it suggests the company was winding down the platform before the incident came to light. The reports do not say how the intruder got in, how long they had access or how many customers were affected.

The coverage also does not say whether customer funds were touched. The notices described by users focus on exposed information, not stolen assets, but the available reporting does not explicitly address the safety of balances, so users should look for confirmation directly from the company. Protos said it contacted Gnosis Pay for comment and had not received an immediate reply.

Part of a broader run of crypto incidents

The Gnosis Pay breach lands amid a rough stretch for the industry. Recent headlines include a reported $391,000 hack at BitMart, losses at Mercado Bitcoin that were reported at $46 million and still growing, and data leaks affecting users of Coinbase and Bithumb. Binance also dropped SignalPlus API keys after a potential hack. Not all of these involve the same kind of failure, but together they show how often crypto firms are targeted, whether for tokens or for customer data.

For card holders, the practical takeaway is caution. After a breach like this, the immediate risks are unsolicited messages that use accurate personal details to look credible, and the possibility of being tied to known wallet addresses. Treat any unexpected email or text referencing your card or account with suspicion, and rely on the company’s official notice rather than links sent by third parties. Customers who want to know exactly which of their details were affected should check the email Gnosis Pay sent them, since the company indicated the scope differed from person to person.

Explore more on this topic with Vexel Search.