Lefteris Karapetsas, founder of crypto portfolio tracker Rotki, said on Nov. 6 that Gnosis Pay had exposed his name, home address, card number and every wallet address linked to his account. In a post on X, he listed the exposed information and wrote that Gnosis Pay had already lost him as a user but could at least have protected his data. A screenshot of a notification attached to the post says unauthorized access to the system powering Gnosis Pay-branded consumer cards was detected on Nov. 3. The notice says the incident was limited to that system and did not affect its enterprise platform for white-label card programs. The notification has not been independently authenticated. No separate public company statement was found at the time of writing, and the number of affected accounts remains unconfirmed. The screenshot lists names, email addresses, phone numbers, home addresses, nationality, linked wallet addresses, and account verification and account status information. For his card, it lists the full number, expiry date and CVV security code. It says IBAN and BIC banking details were also viewed for customers who had an IBAN through Monerium. According to the screenshot, containment began within two hours of detection, security credentials were replaced and a contributing vulnerability was addressed. It says copies of identity documents and dates of birth were not involved, and that his card was cancelled on Nov. 3. The notice says a review found no suspicious card activity and no funds moved from his account. The alleged combination of wallet addresses and personal details creates a risk beyond card fraud: someone with that information could connect a named person and home to public onchain activity. Guidance from Gnosis Pay says transactions remain permanently visible on Gnosis Chain and can be viewed by looking up a Safe wallet address on a block explorer. Security firm CertiK warned in an analysis of a separate Ledger customer-data leak that exposed personal details can support targeted phishing, and that knowing where a crypto holder lives can enable physical coercion to obtain a recovery phrase. Those are potential risks, not evidence of attacks against Gnosis Pay cardholders in this incident. Gnosis Pay provides card-payment infrastructure connecting crypto wallets to traditional payments. It is already winding down its direct consumer offering, with cards scheduled to stop working on Dec. 20, as The Defiant previously reported. Closing an account does not erase all its records: guidance from Gnosis Pay says it retains identity-verification and transaction records for five years after account closure.