Gnosis Pay made 3D Secure verification mandatory for online card payments after disclosing a breach of the legacy system behind its branded debit cards. The requirement will remain in place until the affected system is retired on Dec. 20, according to The Block’s report published on Nov. 6, 2026.
Customer information exposed; funds unaffected
Unauthorized access was detected on Nov. 3, exposing certain customer information. Gnosis Pay said it contained the incident within two hours, replaced compromised security credentials and addressed the vulnerability.
The company said customer funds were not affected. Its enterprise platform, which powers white-label card programs, was also untouched.
What changes for online card payments
For users of the affected card system, the operational change is mandatory 3D Secure verification when making online card payments. That requirement continues through the system’s scheduled retirement on Dec. 20.
The reported exposure concerns customer information, rather than a loss of customer funds—a distinction that also matters when comparing this incident with other crypto-card security failures.
Other card incidents had different outcomes
The Block placed the disclosure alongside other incidents involving crypto-card infrastructure and customer data:
- Based: An attacker accessed an internal dashboard used to manage its Visa card program on Oct. 5. Some customer data was exposed, but the attacker reportedly failed to access deposited funds.
- Rain infrastructure: In August, a vulnerability in Rain’s Solana card infrastructure allowed unauthorized withdrawals from card balances belonging to users of Tria and Avici.
- Revolut: The company said an unauthorized third party used a fraudulent request from a legitimate government email domain to obtain sensitive customer information. That information potentially included account statements, identity documents and Bitcoin transaction histories. Revolut said customer funds and systems were unaffected.
These incidents involved different points of failure and different consequences: exposure of personal information did not always mean funds were accessible, while the Rain infrastructure vulnerability did enable unauthorized withdrawals.
Original source: The Block. Published Nov. 6, 2026, at 18:57:56 UTC (Nov. 7 at 02:57:56 UTC+8).