Gnosis Pay: a leak exposes its customers' card numbers and wallets
On Friday, 6 November, Gnosis Pay published a statement about unauthorized access to the legacy system that runs its branded Visa cards, which are linked to a Safe on Gnosis Chain. The intrusion was detected on 3 November and shut down in less than two hours, but customers only got an email on the 6th. The number of affected accounts hasn't been disclosed.
Cointelegraph was able to read the notifications, and Lefteris Karapetsas, a former customer, posted a screenshot of one. The intruder saw the name, postal address, email, phone number, full card number with expiry date and security code, the addresses of linked wallets and in some cases the IBAN. Funds are intact, and so are the white-label cards from the platform's business offering.
Gnosis Pay replaced the compromised credentials and is requiring 3D Secure verification on online payments until 20 December, the date these cards are discontinued. The real risk is targeted phishing, since identity, postal address and wallet addresses end up in the same file. Transaction history, for its part, can only be exported until that date.
Gnosis Pay: data from its crypto card customers has leaked
Gnosis Pay offers a Visa card linked to a crypto wallet (an online account whose keys you hold yourself). On Friday, 6 November, the company announced that an intruder had been able to read its customers' data. The intruder was spotted on 3 November and blocked in less than two hours. According to the messages sent to affected customers, the intruder saw the name, postal address, full card number, email, phone number and the addresses of the crypto wallets linked to the account. No crypto and no euros were stolen.
If you have a Gnosis Pay card and your data is part of the batch, you were notified by email on Friday. The risk isn't direct theft but scams, because someone who knows your name, your address and your holdings can write a very convincing message. Gnosis Pay never asks for your recovery phrase (the words that give access to your crypto wallet), your PIN or your card number. These cards stop working on 20 December anyway.
Read the expert version
Gnosis Pay: the intrusion into the legacy card system exposed card numbers and CVVs
The intrusion took place on 3 November, on the legacy system behind the Gnosis Pay-branded cards, issued by Monavate under a Visa license. Gnosis Pay says it shut it down in less than two hours and changed the credentials, but it only published its statement and wrote to customers on 6 November.
The customer notifications list identity data (name, nationality, postal address, email, phone number), the full PAN with expiry date and CVV, the addresses of linked wallets, and IBAN and BIC for Monerium accounts. The contracts (Safe, Delay and Roles modules) and the funds are intact, unlike in the June exploit ($1.5 million).
We still don't know how many accounts are affected, how the intruder got in, or who it is. GDPR notification and card replacement are still pending. With no funds moved, there are no disposals to account for. The card spends EURe (a euro stablecoin) from the Safe: under French tax rules, each purchase is a disposal of a digital asset (Article 150 VH bis of the French tax code) included in your overall capital gain, unless your disposals for the year total less than €305. Transaction history can only be exported until 20 December. Finally, the leak links identities to on-chain addresses, public history included.
