If you use a Gnosis Pay card, check your email — and then read this, because the headline "funds are safe" is only half the story.
Gnosis Pay disclosed on Friday that hackers got into the legacy system behind its branded crypto cards. They spotted the intrusion on November 3 and contained it within two hours. Customer funds weren't touched, and the enterprise platform that powers white-label cards for other companies wasn't affected. That's the good part, and it's what the company led with.
Here's what the breach notifications actually list, per Cointelegraph, which reviewed them: full card numbers, expiry dates and CVV codes — plus names, home addresses, email addresses, phone numbers, nationalities, and the wallet addresses linked to those accounts. In some cases even IBAN and BIC banking details. Affected cards were cancelled on November 3 and no suspicious transactions were found, but Gnosis Pay hasn't said how many customers were hit.
My take: "funds safe" misses the real risk here. A card number plus a CVV can be replaced. A home address tied to a known crypto wallet address cannot. That combination is exactly what targeted phishing is built from — and the people holding a crypto debit card are precisely the people scammers want to find. This is the card product from the Gnosis ecosystem, the project behind the $GNO token, and that link between a DeFi name and TradFi card data is exactly the problem: one leak connects your real-world identity to your on-chain holdings.
What I'd do if I held one of these cards: treat every "Gnosis Pay support" message from now on as fake until proven otherwise, watch for phishing and SIM-swap attempts, and remember the whole consumer card platform shuts down on December 20 anyway — it was already scheduled to retire before this happened.
Do you still trust crypto debit cards with your real identity, or is this the last straw for linking your wallet to your name?
Gnosis Pay disclosed on Friday that hackers got into the legacy system behind its branded crypto cards. They spotted the intrusion on November 3 and contained it within two hours. Customer funds weren't touched, and the enterprise platform that powers white-label cards for other companies wasn't affected. That's the good part, and it's what the company led with.
Here's what the breach notifications actually list, per Cointelegraph, which reviewed them: full card numbers, expiry dates and CVV codes — plus names, home addresses, email addresses, phone numbers, nationalities, and the wallet addresses linked to those accounts. In some cases even IBAN and BIC banking details. Affected cards were cancelled on November 3 and no suspicious transactions were found, but Gnosis Pay hasn't said how many customers were hit.
My take: "funds safe" misses the real risk here. A card number plus a CVV can be replaced. A home address tied to a known crypto wallet address cannot. That combination is exactly what targeted phishing is built from — and the people holding a crypto debit card are precisely the people scammers want to find. This is the card product from the Gnosis ecosystem, the project behind the $GNO token, and that link between a DeFi name and TradFi card data is exactly the problem: one leak connects your real-world identity to your on-chain holdings.
What I'd do if I held one of these cards: treat every "Gnosis Pay support" message from now on as fake until proven otherwise, watch for phishing and SIM-swap attempts, and remember the whole consumer card platform shuts down on December 20 anyway — it was already scheduled to retire before this happened.
Do you still trust crypto debit cards with your real identity, or is this the last straw for linking your wallet to your name?
