Gnosis Pay revealed a security breach impacting the older architecture driving Gnosis Pay-labeled debit cards, leaking specific user details following the detection of unauthorized entry on November 3.
The organization stated that it isolated the event in a span of two hours, renewed vulnerable authentication credentials, and patched the security flaw, emphasizing that user balances remained secure and its business infrastructure supporting white-label card solutions remained completely separate.
Gnosis Pay has instituted mandatory 3D Secure authentication for web-based card transactions until the compromised platform is permanently shut down on December 20.
Firms offering crypto cards lean heavily on external infrastructure and outdated systems that frequently introduce security risks. Over the past few months, multiple incidents have leaked cardholder details and compromised balances stored inside card accounts.
Based noted that an intruder gained entry to an administrative panel handling its Visa card initiative on October 5. Certain user information leaked, though the perpetrator reportedly could not reach stored balances. Back in August, a security flaw within the Solana card framework utilized by Rain permitted illicit withdrawals from card funds belonging to customers of Tria and Avici.
Concurrently, Revolut announced that an unauthorized entity leveraged a deceptive inquiry originating from a valid government email address to acquire private user details, potentially encompassing account records, verification papers, and Bitcoin activity logs. User balances and internal networks remained untouched.
Originally published at https://www.theblock.co/news/defi/2026-11-06-gnosis-pay-data-breach-legacy-debit-card-system-435934.
