Crypto Debit Card Breach at Gnosis Pay Leaves Customer Funds Untouched

Gnosis Pay said it detected unauthorized access on November 3, 2026, to the system that powers its branded crypto debit cards.

The company disclosed the incident on November 6 and said customer funds were not affected. It also said its enterprise platform, which powers white-label card programs for partners, was not touched.

A payments layer can expose personal information even when balances stay put. Gnosis Pay did not publish a public inventory of every field that was taken, and said each affected customer received an email describing exactly what information was accessed from their account.

For Bitcoin holders, the constructive reading is not that cards make self-custody pointless. It is that a spending card and a long-term self custody wallet should not be treated as the same thing.

What Gnosis Pay Says Happened

According to the company’s November 6 notice, monitoring systems flagged unauthorized access to the consumer card system on November 3. That system supports Gnosis Pay-branded cards, which the firm describes as its business-to-consumer line.

The security team said containment began within two hours of detection. It then replaced the affected security credentials and addressed the vulnerability.

The company said the breach was limited to that consumer system, which was already scheduled for retirement on December 20, 2026. A scheduled retirement is not evidence that the firm expected this intrusion.

Gnosis Pay Co Ltd is a UK-registered company, number 14919639. The notice said the debit card is issued by Monavate Limited under a Visa Europe licence. Monavate is authorized by the Financial Conduct Authority as an electronic money institution, with firm reference number 901097.

How the Company Is Responding

Gnosis Pay said it has increased monitoring of card activity and wallets to watch for fraud or attempts to reach user funds. It also made 3D Secure mandatory for every online card payment until the consumer system is retired on December 20.

The company said it is arranging specialist monitoring for signs of misuse, had emailed every affected customer, reported the breach to its partners, and was communicating with data protection authorities and its card issuer.

It did not say how many customers were affected, and we would not fill in that missing number.

What Crypto Debit Card Customers Should Do Now

Gnosis Pay told customers to treat unexpected emails, texts, calls, or letters about the company, a partner app, or their card with suspicion, even when the message includes real personal details or a real purchase.

It told people not to click links in those messages and to open the official Gnosis Pay web app or the relevant partner app directly instead.

Customers should never share a seed phrase, private keys, a PIN, or a full card number. The company said it and its partner apps will never request those details, will never ask someone to re-verify their identity by email or text, and will never ask anyone to move funds by those channels.

It also warned people to be careful about who they share their address with, or details of their crypto holdings. A home address paired with information about crypto holdings is useful to a scammer, even if the coins themselves never left a wallet. Affected customers with questions were pointed to [email protected].

Bitcoin Held Near $76,000 as the Notice Came Out

The intrusion was detected on a day when Bitcoin’s CoinGecko daily USD price was about $76,709. On November 6, the day of the public disclosure, that daily print was about $76,006.

When we retrieved CoinGecko data on November 8, 2026, at 22:29 Asia/Jerusalem, Bitcoin was about $75,794, up roughly 0.12 percent over 24 hours. From August 11 through November 8, daily USD prints ranged from about $62,844 on August 17 to about $86,597 on September 22.

As we covered after the Keplr wallet breach and after LNbits told operators to take lightning wallet servers offline, software that sits between a person and their coins can fail without Bitcoin’s base-layer rules breaking.

Why a Self Custody Wallet Should Stay Separate From a Spending Card

A crypto debit card is a convenience layer. It can make bitcoin easier to spend at ordinary merchants. It also introduces a company, an issuer, and a consumer database into a process that Bitcoin itself does not require.

We believe that is the useful lesson. The network kept producing blocks while a card processor dealt with a consumer-system breach. mempool.space data retrieved on November 8, 2026, at 22:29 Asia/Jerusalem, put the current difficulty at about 148.36 trillion and the current hashrate at about 978 exahashes per second.

The same source’s daily average hashrate was about 910 EH/s on November 3, about 955 EH/s on November 6, and about 989 EH/s on November 8. From August 9 to November 8, daily averages ranged from about 782 EH/s to about 1,228 EH/s.

The practical step is to keep a long-term self custody wallet away from any card or app that stores a name, a home address, or a spending history. That does not make every wallet immune to bugs. It does reduce the chance that a breach at a payments firm can connect a person’s identity to their bitcoin savings.

We have made a similar argument when looking at why self-custody can matter during a banking shock. A spending card can still be useful. It should not be the place where savings live.

For now, the facts are the ones Gnosis Pay stated. Unauthorized access hit its branded consumer card system on November 3. Funds were not affected. Extra card checks stay in place until December 20. And Bitcoin itself kept clearing transactions on its own terms.