Gnosis Pay reported a data breach involving the system that powers its branded payment cards, which it discovered on November 3, 2026. The company said unauthorized access exposed certain customer information, although users’ funds were not affected.

In a November 6 statement, Gnosis Pay said the breach was limited to its business-to-consumer line. Its corporate platform, which supports partner card programs, was not affected.

Gnosis Pay said it emailed every affected customer with details about the specific information accessed from their account. The company also notified its partners, relevant data protection authorities and the card issuer.

“We deeply regret that this happened. While funds were not affected, the security of personal information is just as important and we take full responsibility,” the company said. It published further details about the incident.

Containment and additional security measures

Gnosis Pay said its security team began responding immediately after detecting the unauthorized access. Containment started within two hours, after which the company replaced compromised security credentials and remediated the vulnerability.

The company introduced additional safeguards that will remain in place until the affected B2C platform is retired as planned on December 20, 2026. The measures include enhanced monitoring of card transactions and wallets for fraud and attempts to access funds, mandatory 3D Secure verification for all online payments, and specialized monitoring for potential misuse of stolen information.

Gnosis Pay said it is conducting a full review of the incident and plans to apply its findings to other systems.

Customers warned about phishing

The company urged customers to be especially cautious about unexpected emails, messages, calls and postal mail purporting to relate to Gnosis Pay, partner applications or payment cards. It said customers should not click links in such communications, even if they contain genuine personal data or purchase information, and should instead open the official Gnosis Pay web application or a partner application directly.

Gnosis Pay said it will never ask customers for a PIN, seed phrase, private keys or their full payment card number. It will also never ask them to transfer funds or re-verify their identity through email or SMS. According to the company, all account changes take place only through the official application.

Gnosis Pay also encouraged security researchers to report vulnerabilities directly to [email protected], saying the same rewards apply as under the Gnosis Chain program.

Other reported security incidents

In October 2026, Layer 1 blockchain Qubic reported that about 2.94 trillion QU had been stolen from 1,404 wallets. According to the Qubic team, insufficient randomness in the generation of parts of some seed phrases caused the incident, rather than a vulnerability in the protocol itself.

Hardware wallet maker Trezor previously disclosed information involving 13,689 customers after its logistics partner ShipMonk was hacked. Trezor said its own systems and devices were not affected.

Keystone also confirmed that names, contact details, shipping addresses and order histories were exposed after its official website was hacked. The hardware wallet maker said private keys, seed phrases and payment information remained secure.

Separately, SlowMist researchers found malicious JavaScript in Udesk’s support system that could steal user data and replace deposit addresses on certain cryptocurrency platforms.

Source: Incrypted