Gnosis Pay disclosed a customer data breach on November 6 after detecting unauthorized access to its legacy consumer card system. The company said customer funds and its enterprise platform remained unaffected, while tighter payment controls will continue until December 20.
Table of Contents
The intrusion was detected on November 3, and security staff began containment within two hours. The company replaced affected credentials and fixed the vulnerability, according to its public statement. It has not identified the attacker.
What Information Was Exposed in the Breach
Gnosis Pay stated that the breach occurred in the infrastructure behind the branded consumer card program of Gnosis Pay. The separate enterprise product line that is used by Gnosis Pay to power card programs for other companies was not implicated.
Also Read: DOGE Price Eyes Momentum as Whale Accumulation Signals Potential Breakout
Each affected individual was notified via email on November 6 regarding the nature of information compromised from his/her account. No affected individual total or category of exposed information is provided in the public notice issued by the company.
No timeline was provided for publication of any additional technical information. Gnosis Pay notified its business partners and the card issuer and related data protection authorities.
How Gnosis Pay Tightened Card Security
The firm implemented the use of the 3D Secure protocol, which requires verification of the identity of the user before the transaction is completed. The policy is expected to be in place until the legacy consumer system is shut down.
Consumers objected to the measures taken by the company following the leak. They asked questions regarding accountability and the possibility of phishing attacks through emails containing leaked data.
Gnosis Pay informed that such emails may include personal data or any legitimate transaction that had been done. It advised the consumers to avoid clicking on the links in emails, texts, and any such messaging application. Users must access the official web app or a partner app.
The firm said it never asks for seed phrases, private keys, PINs, or full card numbers through messages. It also warned against requests to move funds or repeat identity verification through unsolicited contact.defiprime.com
When Will the Consumer Card Service Close
The shutdown in December 2020 happened before the breach in November. According to a notice by Gnosis Pay on September 21, branded physical and virtual cards were to stop authorizing transactions after 23:59 UTC on the same day.
The web app will cease providing services except for withdrawal purposes. Users will be able to retain ownership of the funds in their self-custodial safe accounts, which will not depend on the availability of the card program anymore.
Users may choose to enter into the partner program to be able to use a card. This is an optional step that involves accepting new terms. Cards will stop functioning whether users opt for the partner program or not.
The notice urges users to make sure that they export transaction histories and update information about recurring payments. General cardholder support will end on June 18, 2027, whereas the refund and chargeback help will end on June 12, 2028.
How the November Breach Differs From June’s Exploit
The data breach came after another attack on the card-wallet system in June. In its July 3 post-mortem, Gnosis Pay admitted that there was a vulnerability in Zodiac modules, allowing the hackers to pull out nearly $1.5 million worth of cryptocurrency.
According to Gnosis, it took the losses in stride and rebalanced the funds for customers. The vulnerability came from an incorrect signature validation in the card-safe software.
Also Read: Thailand to Block Bitget on December 5 Over Unlicensed Trading
Arslan Tabish is a Technical Reporter and Market Analyst at Tron Weekly with over five years of experience covering cryptocurrency markets and blockchain developments. His reporting focuses on Bitcoin, Ethereum, altcoins, and decentralized finance, alongside NFTs, crypto regulation, policy, and Web3 innovations.
Arslan covers blockchain technology, Layer 2 scaling solutions, and emerging use cases, including AI-driven crypto applications, while delivering clear market analysis on how technical and regulatory developments impact digital asset markets. His work is designed for both beginners and experienced readers, offering accurate, easy-to-understand reporting without speculation or investment guidance.
