Gnosis Pay breach spilled founder's home address and wallet links, Rotki's Karapetsas says

Lefteris Karapetsas, the founder of crypto portfolio tracker Rotki, says Gnosis Pay leaked some of the most sensitive data he had handed over — his name, home address, card number and every wallet address connected to his account. He posted the claim on X on Nov. 6, adding that the company had already lost him as a user but could have at least protected his data.

The receipt he shared is a notification screenshot describing unauthorized access to the system running Gnosis Pay-branded consumer cards, detected on Nov. 3. That notice says the intrusion was confined to that system and left the enterprise platform for white-label card programs untouched. It has not been independently verified, no separate public company statement was found, and the number of affected accounts is still unknown.

According to the screenshot, the exposed fields include names, email addresses, phone numbers, home addresses, nationality, linked wallet addresses and account-verification and status details. It also lists his card's full number, expiry date and CVV code, plus IBAN and BIC banking information viewed for customers who held an IBAN through Monerium.

The notice claims containment started within two hours of detection, security credentials were swapped out and a contributing vulnerability was fixed. Identity-document copies and dates of birth were not involved, it says, and Karapetsas' card was cancelled on Nov. 3. A review turned up no suspicious card activity and no funds left his account.

Pairing wallet addresses with personal details is a bigger problem than card fraud. Anyone holding both could tie a real name and a home to public onchain activity — and Gnosis Pay's own data guidance notes that transactions stay permanently visible on Gnosis Chain, viewable by looking up a Safe wallet address on a block explorer. CertiK, analyzing a separate Ledger customer-data leak, warned that exposed personal details fuel targeted phishing and that knowing where a crypto holder lives can enable physical coercion to extract a recovery phrase. Those are potential risks, not evidence of attacks on Gnosis Pay cardholders here.

The timing stings: Gnosis Pay is already winding down its direct consumer offering, with cards set to stop working on Dec. 20. And closing an account doesn't wipe the paper trail — the company's data guidance says identity-verification and transaction records stick around for five years after closure.