On November 6, 2026, Gnosis Pay disclosed a customer-data breach on the legacy system behind its branded consumer cards. The company said it detected unauthorised access on November 3, began containment within two hours and later replaced the affected security credentials and addressed the vulnerability.
The disclosure limits the incident to the consumer business line. Gnosis Pay says its enterprise platform, which powers white-label card programmes, was unaffected. It also says customer funds were unaffected. The claim about funds comes from the operator; wallet balances have not been independently verified.
The company has made 3D Secure verification mandatory for all online card payments and increased monitoring of card activity and wallets for fraud or attempts to access funds. Those measures will remain until the consumer system is retired on December 20, 2026. The closure was already scheduled before the breach.
What the disclosure tells cardholders
Gnosis Pay says it emailed every affected customer with the specific information taken from their account. Its public notice describes the exposure as customer information but gives neither a complete list of affected data fields nor a customer count. The emails contain the details of each customer’s exposure and additional recommended actions.
The company says it reported the breach to partners and is communicating with the applicable data protection authorities and its card issuer. It is conducting a full review and arranging specialist monitoring for signs that someone is misusing the exposed information. The disclosure does not identify the attacker or explain the vulnerability beyond saying it has been addressed.
Its immediate warning covers unexpected emails, texts, calls and letters about Gnosis Pay, partner apps or a card. A message can contain genuine personal details or a real purchase and still be suspect. The company tells customers to avoid links in those messages and open the official web app or their partner app directly.
Gnosis Pay says neither it nor partner apps will request a seed phrase, private keys, PIN or full card number. They will not ask customers to re-verify their identity by email or text, or to move funds by email, text or phone. Account changes take place inside the official apps. The notice also cautions customers about sharing their address or details of crypto holdings, online and offline.
The legacy platform was already closing
The retirement schedule comes from a formal notice issued on September 21, before this incident. Both physical and virtual Gnosis Pay cards stop authorising transactions at 23:59 UTC on December 20, 2026. The consumer web app closes at the same time except for withdrawals. A customer who does nothing will still lose access to card payments at that deadline, whether or not they join a partner programme.
The notice describes a move away from consumer-facing services toward enterprise card programmes. Joining a partner programme requires a new contract, with its own eligibility rules, supported currencies and blockchains, foreign-exchange arrangements, limits, fees and rewards. Existing card terms do not automatically carry across.
The migration instructions require customers to accept the new terms and confirm deactivation of their existing card and termination of its agreement. Customers must also create a new Safe, separate from the current account, and fund it themselves. Moving to a partner is optional. The notice says customers retain rights that survive the end of their existing agreement.
Subscriptions and other recurring card payments fail after the old card stops working. Gnosis Pay and Monavate cannot transfer them to a replacement card, so customers must update their details with each merchant. Transactions authorised before closure can still settle normally. Unsettled authorisation holds are released under the applicable card-scheme rules.
The company tells customers to export their transaction history and retain the card’s last four digits and expiry date before the web app closes. Those records support later refunds, disputes and chargebacks. Monavate continues retaining records for the legally required period, during which customers can request copies.
Withdrawal access and dispute rights continue
Under the retirement notice, the existing Safe remains a self-custodial smart-contract account on Gnosis Chain. The notice says ownership and access to its assets survive the end of the card programme. Customers retain their signer key and can use a compatible third-party Safe interface. The web app’s withdrawal function is also scheduled to remain available after closure.
Gnosis Pay’s preparation guidance tells customers to check that they can still open the wallet that owns their Safe. It suggests signing into the web app with that wallet to check access. It also advises keeping the recovery phrase safely stored. This is guidance for retaining access to the account, not a request to disclose a phrase to support.
An existing euro IBAN continues operating after the card closes. The company’s continuity guidance says the IBAN is linked to the wallet and provided by Monerium, rather than Gnosis Pay. Incoming transfers continue arriving in the customer’s wallet.
Card retirement preserves rights concerning unauthorised or incorrectly executed transactions and chargebacks, although individual card-scheme deadlines still apply. General cardholder support ends on June 18, 2027; support for refunds, disputes and chargebacks continues until June 12, 2028. Neither date limits withdrawal of the customer’s assets.
The formal notice identifies Monavate Ltd as the issuer for UK and other applicable non-EEA cardholders, and UAB Monavate for EEA cardholders. Gnosis Pay is the technical services provider and programme manager. Monavate handles payment-service complaints under the cardholder contract. Customers can contact it directly or send a complaint through Gnosis Pay for forwarding.
Monavate aims to provide a final complaint response within 15 business days. If that is not possible, the notice says it will explain the delay and respond within 35 business days at the latest. These deadlines cover payment-services complaints under the existing closure notice; they set no timetable for Gnosis Pay’s breach investigation.
Gnosis Pay has not published a completion date for its review or a full technical account of how the unauthorised access occurred.
