The cryptocurrency payment service Gnosis Pay has suffered a serious security incident: a leak of customers' personal and financial data occurred. Attackers gained access to users' confidential information, putting both their digital assets and physical safety at risk.
According to notifications sent to affected customers, the attackers obtained bank card numbers, home addresses of account holders, as well as information about cryptocurrency wallets linked to the accounts. This combination of data is particularly dangerous: linking financial details with physical addresses creates risks not only for users' funds but also for their personal safety.
Scale and Nature of the Threat
Payment services at the intersection of traditional finance and the crypto industry are traditionally an attractive target for malicious actors. Gnosis Pay, which enables spending digital assets through card payments, accumulates several categories of sensitive data at once — from banking infrastructure to blockchain addresses. A leak of this volume of information requires immediate action from users: reissuing cards, tightening control over wallets, and increasing vigilance against phishing attacks, which are highly likely to follow the incident.
At present, the key question is how deeply the attackers managed to penetrate the service's infrastructure and whether private keys or funds in accounts were compromised. The very fact of access to the "card — address — wallet" combination significantly increases the risk of targeted attacks, including social engineering and attempts at unauthorized access to accounts.
Cryptalist Analysis: The Gnosis Pay incident highlights the systemic vulnerability of hybrid crypto-fiat services, where the concentration of personal and financial data creates heightened risks. The market should expect increased regulatory scrutiny of the practice of storing KYC and payment information on such platforms. For investors and users, this is a signal of the need to diversify risks and give preference to services with transparent security policies and non-custodial asset storage models.