Gnosis Pay breach exposes Rotki founder’s address, card and wallet details
The crypto payment card provider said unauthorized access to its legacy consumer‑card system on Nov 3 exposed some customer data, including the personal details of Rotki’s founder. The firm said funds were safe and has made 3D Secure mandatory.
Key takeaways
- 1Unauthorized access to Gnosis Pay’s consumer‑card system on 3 Nov 2026
- 2No customer funds or enterprise platform were accessed, according to Gnosis Pay
- 33D Secure made mandatory for all online card payments after the breach
- 4Legacy B2C card system scheduled for retirement on 20 Dec 2026
- 5Rotki founder confirmed his address, card and wallet details were exposed
Gnosis Pay said unauthorized access to its consumer‑card system on Nov 3 exposed some customer data, and Rotki founder confirmed his personal address, card and wallet details were among the compromised information. The breach was reported on Nov 6 by Wu Blockchain and The Defiant.
The company detected the intrusion within two hours, isolated the legacy B2C card platform, replaced all compromised credentials and began a full containment process. It said funds and its enterprise white‑label card platform were untouched. Gnosis Pay also made 3D Secure mandatory for all online card payments, increased monitoring of cards and wallets, and engaged an external security firm to audit the code. The breach was limited to the legacy system that processes consumer card transactions, not the newer enterprise API used by business partners.
The incident follows a spate of recent crypto‑related data breaches. YourKhabri reported Bithumb’s employee‑mobile system breach on Oct 27, BitMart’s minor breach on Nov 4 and Solflare’s high‑security alert on Nov 3. Each case involved unauthorized access but no loss of user funds, showing a pattern of targeting peripheral systems rather than core trading engines.
Gnosis Pay will retire the legacy card system on Dec 20, moving customers to a newer platform that meets current security standards. Affected users have been notified and advised to monitor card statements and wallet activity for any unauthorised transactions. The firm said it will work with regulators in the US, EU and other jurisdictions to ensure compliance.
No regulator has issued a formal enforcement action yet, but the US SEC and the EU’s ESMA have warned that data‑privacy failures could trigger supervisory reviews under existing crypto‑service rules. Analysts expect exchanges and card issuers to review their authentication layers, as regulators may cite this breach when drafting guidance on crypto‑payment services. Traders will watch whether the incident accelerates adoption of mandatory 3D Secure across the sector.
Also reported by
Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.