Gnosis Pay Breach Exposes Card and Wallet Data, and the 72-Hour GDPR Clock Is Now Running

Gnosis Pay says customer funds are safe after a breach that exposed card details, personal data, and crypto wallet information, which is the exact sentence every crypto card issuer hopes it never has to publish.

The Sequence

The order of events matters more than the headline. Gnosis Pay, the card arm spun out of the Gnosis network and built on Safe smart accounts, went public with the incident and got ahead of the most obvious question first. Money didn't move. Funds weren't touched. That was the priority, and you can see why. A card program lives or dies on the assumption that the balance behind it's still there when you tap the terminal.

Then came the harder part of the disclosure. Card details, personal data, wallet information. Three categories, one breach, and they don't carry the same risk.

Card data is the most mechanical piece of the puzzle. Card numbers, expiry dates, names, whatever sat in the issuer's systems. That's replaceable. It's annoying, it's expensive, and it's a solved problem in the traditional payments world. Kill the PANs, reissue, move on.

Personal data is the piece that never really gets fixed. Names, addresses, identity documents, the KYC file you handed over to get a card in the first place. You can't reissue a passport number.

And wallet information is the new wrinkle. Gnosis Pay sits at the junction of a Visa card and an onchain account, which means the breach surface includes addresses and whatever else the platform stored about how those addresses connected to real humans. That's a targeting list. Anyone holding it knows which wallets belong to people who've already proven they'll move money through regulated rails.

The regulatory clock started the moment the company became aware. Under GDPR, notification to a supervisory authority is due within 72 hours of that awareness. Under the EU's Digital Operational Resilience Act, which has applied since January 17, 2025, financial entities and their critical IT providers face tighter incident reporting windows and heavier oversight. Gnosis Pay operates in Europe. Both regimes apply.

The Impact

Here's where I'll be blunt. "Funds are safe" is technically accurate and strategically useless.

The funds were never the interesting part. The interesting part is that a crypto debit card collects more sensitive data than almost any other product in this industry. It wants your identity documents because it's a regulated payment instrument. It wants your card credentials because it's riding Visa's network. It wants your wallet because that's the settlement layer. One platform, three datasets, and a single point of failure that ties your legal name to your onchain history.

So what does the attacker actually get to do with it? Mostly, they get to be patient. Card fraud is fast. Identity-driven phishing is slow, and it's far more profitable. Picture the message that shows up six weeks from now, referencing your actual wallet address, your actual card ending digits, your actual street name. That's not a generic scam email. That's a spear phish with a real return on investment, and it works because the attacker did their homework.

There's a second, quieter cost. Card reissuance runs somewhere between a few dollars and roughly $10 to $15 per card once you bundle production, postage, and customer service. Add the fraud department, the incident response retainer, the outside counsel, the credit monitoring offer. Then add the regulatory exposure. GDPR penalties scale to 4% of global annual turnover, and DORA gives supervisors an entirely separate toolkit.

Now zoom out to the market. Crypto doesn't exist in a vacuum, and neither do crypto card programs. These products are the retail on-ramp that turns stablecoin balances into coffee purchases, and they've been one of the few genuinely working consumer use cases for tokenized fiat. Every card breach makes that bridge look a little less sturdy. Issuers get stricter. Underwriters get pickier. The compliance bill goes up for everyone, and smaller programs without the balance sheet to absorb it quietly stop issuing.

This is a cross-asset story, whether or not anyone wants to frame it that way. Every card program is a Visa or Mastercard partnership wearing a crypto costume. When the costume tears, it's the payments networks and their issuing banks who start asking harder questions about who they're sponsoring. That's adding headwinds to an already fragile setup.

Who wins? The custodial, heavily audited players with real security budgets, the ones who've been boring about infrastructure for years. Who loses? The lean startup card programs that treat security as a line item rather than a product. And, of course, the users who now have to decide whether the convenience of spending onchain was worth handing over their passport.

The Outlook

Watch the reissuance window. Card programs typically aim to have compromised credentials out of circulation within two to four weeks, which puts the meaningful deadline in the middle of this quarter. If you hold a Gnosis Pay card and you haven't been told to expect a replacement, that's the question to ask.

Watch the supervisory filings too. A 72-hour GDPR notification either happened or it didn't, and that's a matter of public record in most EU jurisdictions. DORA reporting adds another layer, and the first real enforcement actions under that framework will set a precedent the whole crypto card sector has to price in.

Then watch the phishing wave. Historically, credential data from breaches of this type gets weaponized 30 to 90 days after the disclosure, once the headlines fade and users stop paying attention. That's the window where a well-crafted message does the most damage.

And watch what it does to the business model. The crypto card pitch has always been simplicity: one account, one card, spend anywhere. The breach makes the hidden cost of that simplicity visible, and the industry's answer will be more custody, more identity checks, more friction. Which is awkward, because friction is exactly what these products were built to eliminate.

The macro backdrop suggests the tolerance for sloppy infrastructure is thinning. Regulators have the tools now. Payments partners have the use. For a sector that spent years arguing it could self-police, this is one more data point that says otherwise.