BTC $75,880 
ETH $2,232 
MGLOEURO $111,813 
USDT $0.9991 
BNB $696.03 
XRP $1.19 
USDC $0.9996 
SOL $90.49 
TRX $0.3187 
FIGR_HELOC $1.03 Hacks & Security · Explained
Gnosis Pay imposes 3D Secure after breach of legacy card system
Gnosis Pay says unauthorized access to its consumer card system exposed customer data, and online payments now need 3D Secure checks until the platform closes.
Key takeaways
- Extra checks. Online payments on Gnosis Pay-branded consumer cards now require 3D Secure verification, a rule that lasts until the system closes on December 20.
- Data varied by account. One reporter was told only a card-printed name, shipping address and account reference were exposed, while another customer reported his card number and all linked wallet addresses.
- Scope. Gnosis Pay says customer funds and its separate enterprise white-label card platform were not affected by the intrusion.
What happened
Gnosis Pay, which issues white-label stablecoin cards, said it found unauthorized access on November 3 to the system that powers its Gnosis Pay-branded consumer cards. The company disclosed the incident on November 6 and confirmed that some customer information was exposed. Alongside the disclosure, it made 3D Secure identity checks compulsory for online card payments, a requirement it says will stay in place until December 20, when the legacy consumer system is retired.
The amount of data involved differed from one account to another. A Protos journalist was told that the exposed details were the name printed on the card, the shipping address and the Gnosis Pay account reference. Lefteris Karapetsas said his own notification listed his full home address, his name, his card number and every wallet address connected to the account.
Gnosis Pay said its security team began containment within two hours of detecting the intrusion, replaced affected credentials and closed the vulnerability that had been exploited. It also stepped up monitoring of cards and wallets for fraud and for attempts to reach customer funds. The company emailed each affected customer on November 6 with details specific to their account, and said customer funds and its separate enterprise card platform were not affected.
First $120.63Latest $113.50-5.9% over the period
Points are daily observations, not closing prices.
Why it matters
The 3D Secure requirement adds an identity-verification step to online purchases at a point when the consumer service has only weeks left to run, so cardholders may face extra friction for a limited period rather than a permanent change. The breach also matters because of the kind of data described: home addresses and wallet addresses are the raw material for convincing phishing attempts aimed at crypto users. Gnosis Pay warned customers to be suspicious of unexpected messages that contain personal details or appear to reference genuine card purchases, and said its support staff would never ask for seed phrases, private keys, PINs or complete card numbers. Separating the affected consumer line from the enterprise white-label business limits the confirmed exposure to the older system rather than every integration that carries the Gnosis Pay name.
What the data shows
The public statement did not put a number on affected users and did not list every category of data involved. It also did not name the intruder or explain how the unauthorized access was obtained. Gnosis Pay said it had notified partners and had started talking to relevant data protection authorities and its card issuer, and that it was reviewing the incident and arranging specialist monitoring for possible misuse of the exposed information.
Customers who want their card transaction histories can export them through the consumer web app until December 20; after that date they have to request the records from the company directly. On-chain records are not a substitute, because blockchain explorers do not display merchant names or card-level transaction details. The December shutdown also does not mean records disappear: Gnosis Pay's published guidance says identity and transaction records are kept for five years after an account is closed, and support correspondence for six years.
Background
The consumer system was already scheduled for closure. Gnosis Pay had announced that it would discontinue its consumer interfaces and move users toward partner applications, and the December 20 date was set before the breach came to light. The incident is separate from the June smart-contract exploit that affected Gnosis Pay wallets, after which Gnosis confirmed that lost funds had been restored. It also fits a wider pattern of crypto-related breaches and attacks reported in recent months. Protos contacted Gnosis Pay for comment and did not receive an immediate response.
What to watch
Attention now turns to the final weeks of the legacy platform and to what follows its retirement. The 3D Secure mandate ends with the system on December 20, so any cardholder who still needs transaction records after that point will depend on the company's request process. It is also not yet public whether the investigation will establish the scale of the breach or the route the intruder took, and whether regulators or the card issuer will require further steps. Customers have been told to watch for fraudulent contact that uses the exposed details.
Questions readers ask
What does 3D Secure add to a card payment?
It inserts an identity-verification step that an online purchase must pass. Gnosis Pay made the check mandatory for its consumer cards after the breach, and it applies until the system is retired on December 20.
How can I get my card transaction history?
Export it from the consumer web app before December 20. After that, records must be requested from Gnosis Pay directly, because blockchain explorers do not show merchant names or card-level transaction details.
Will my data be erased when the system shuts down?
Not immediately. Gnosis Pay's guidance says identity and transaction records are retained for five years after an account closes, and support correspondence for six years.
