Gnosis Pay breach leaks card numbers and addresses of crypto users

Here's what happened. Gnosis Pay says its monitoring spotted unauthorised access to the older system behind its own-brand debit cards on 3 November. It started containing the attack within two hours, replaced the affected security credentials and fixed the flaw.

The company has not said how many people were affected. But one customer, Rotki founder Lefteris Karapetsas, shared the warning email he received. It listed his name, full home address, card number and every wallet address linked to his account, CoinDesk reported.

Customer funds were not touched, and the separate platform that runs card programmes for other businesses was not affected, Gnosis Pay said. It has made an extra security check mandatory for online card payments until the old system shuts on 20 Dec, and warned that scammers may use the stolen details to send convincing fake messages.

Put it in context. Gnosis Pay handles about $67.6m a year in card payments, according to Paymentscan data cited by CoinDesk. It lost about $1.5m to a software flaw in June, which Gnosis covered. And it is not alone: The Block notes that Based reported an attacker got into its Visa card dashboard in October.