Gnosis Pay confirmed that unauthorized access on Nov. 3, 2026, compromised data held in the legacy system processing its retail Visa debit cards. The exposed information included purchase details, addresses and other personal data, while customer funds, wallet holdings and the company’s enterprise white-label platform were not affected. Gnosis Pay said its security team contained the incident within two hours by cutting off access through compromised keys. Card issuer Monavate Limited, regulated by the UK’s Financial Conduct Authority, continues to operate. The consumer platform is scheduled to shut down on Dec. 20. Gnosis Pay has emailed affected users with account-specific details, increased transaction monitoring and made 3D Secure mandatory for online payments until closure. It warned that attackers may use exposed information in phishing attempts and said neither it nor its partner apps will request seed phrases, private keys, PINs or full card numbers to verify or cancel transactions. Existing data guidance says identity and transaction records are retained for five years after account closure and support correspondence for six years; customers can export transaction histories through the consumer web app until Dec. 20, after which records must be requested directly. The disclosure is separate from a June smart-contract exploit affecting Gnosis Pay wallets, for which Gnosis previously said it restored lost funds, and follows other reported crypto-security incidents in 2026.