Gnosis Pay has disclosed a data breach that exposed customer card numbers, home addresses and the crypto wallets linked to their accounts. The company confirmed the incident this week, though it hasn't said how many users are affected or how the data got out. For anyone who used the card to spend on-chain, the leak stitches together three things that were never meant to sit in the same file.
What actually leaked
The exposed fields are the ones that matter most for identity-linked payments. Card numbers are enough to attempt fraud on their own. Home addresses turn an anonymous wallet into a physical location. And the linked-wallet data is the piece that makes this breach different from a typical card incident — it connects a person's real-world identity to the addresses they use to move funds.
Gnosis Pay hasn't published a breakdown of which records were compromised or whether the data was encrypted at rest. The company also hasn't said whether the breach came from an internal system, a third-party processor or an external attacker.
One user's account of the leak
At least one user has described what the exposed data looked like from the inside. He said the leaked records tied his home address and card number to every crypto wallet linked to his account. That's a complete map of his on-chain activity sitting next to his front door.
The same user said the exposure raises the risk of targeted scams. It's not hard to see why. Someone holding that combination could impersonate a payment provider, reference a real transaction and ask for a confirmation code — and the victim would have little reason to doubt it.
Why this is worse than a card-only breach
Card breaches usually end with a reissue and a few awkward weeks of declined payments. This one has a longer tail. Wallet addresses are permanent. A home address doesn't change because a card got cancelled. And the link between the two is exactly what a phishing campaign or a physical confrontation needs to look credible.
Gnosis Pay has not said whether it plans to reissue cards, rotate account identifiers or notify users individually. It also hasn't commented on whether affected wallets should be treated as compromised.
The unanswered questions
The company hasn't given a timeline for a fuller disclosure. Users still don't know if their specific records were in the exposed set, how long the data was accessible, or whether the breach is contained. Those are the questions a paying customer would ask first — and right now there are no public answers.
Until Gnosis Pay says more, the practical advice for anyone who used the card is the same as it would be after any identity-linked leak: assume the combination of your address and your wallets is known, and treat unsolicited messages that reference either one as hostile.
