coindesk.com
Crypto debit card provider Gnosis Pay has disclosed a data breach that exposed customers' personal and financial details, including home addresses, card numbers and linked cryptocurrency wallets.
The breach raises the risk of targeted scams, as attackers could use the stolen data to connect users' real-world identities with their crypto holdings.
Lefteris Karapetsas, founder of crypto portfolio tracker Rotki, said on X, sharing an email received from the firm, that the exposed data included his name, full home address, card number and every wallet address linked to his account.
"You had already lost me as a user but you could have at least protected my data," he wrote.
Gnosis Pay, which was unveiled in 2023, lets customers spend stablecoins through Visa debit cards linked to their crypto wallets. It has an annualized payments volume of around $67.6 million, according to Paymentscan data.
The company said it detected the intrusion on Nov. 3 and started containing it within two hours. It replaced affected security credentials and fixed the flaw that allowed the breach.
Customer funds were not affected, nor was the project’s separate enterprise platform, which powers card programs for other businesses, the firm said.
Gnosis Pay did not disclose how many customers were affected, and said it emailed each affected user with details of the exposed information.
The incident follows a June exploit that drained about $1.5 million through a wallet software flaw. Gnosis covered those losses and restored customer funds.
The company has since made 3D Secure verification mandatory for online card payments and increased fraud monitoring ahead of the legacy consumer system's planned Dec. 20 shutdown.
It also warned that scammers could use stolen personal details and past purchase information to make fraudulent messages appear legitimate.
