Gnosis Pay Confirms Breach of Card Customer Data

gm, Defiers!

These are the biggest stories in DeFi and crypto:

• Gnosis Pay confirmed a breach of card customers' data
• Elliptic says Binance hackers swapped $50M of XRP
• Aave Labs bought Avon's team to build fixed-rate loans
• Threshold set a Friday night restart for tBTC
• Blockaid warned of a reth bug that skews state proofs

Lefteris Karapetsas, founder of the portfolio tracker Rotki, posted a list this morning. It showed what Gnosis Pay had exposed about him: his name, home address, full card number with its security code, and every wallet address linked to his account.

Gnosis Pay sells a Visa debit card that spends from the user's own Safe wallet on Gnosis Chain. Hours after Karapetsas posted, the company confirmed the breach. It says it detected unauthorized access to its consumer-card system on Nov. 3, that no funds moved, and that it emailed every affected customer. Gnosis Pay has not said how many customers that is.

On June 1, an attacker exploited the delay module that guards Gnosis Pay accounts. The company's post-mortem put the damage at about $1.8 million, and Gnosis covered the losses. Gnosis Pay then redeployed its account modules in tranches. By our count from Gnosis Chain logs, it set up about 71,100 card accounts on the new template that month, then 5,087 in July. On Sept. 21, Gnosis Pay told cardholders it would retire its consumer cards on Dec. 20 and sell card programs to other companies. In October, it set up 1,731 new accounts. The breach came 47 days before the shutdown.

A Gnosis Pay account is a Safe smart account. The user keeps the keys, and a module lets the card spend from the Safe within set limits. Card payments settle on Gnosis Chain, so anyone with a Safe's address can read its spending history. Visa card issuers must still verify each customer's identity. That gives Gnosis Pay one file that ties a name and a home address to a public wallet. The notice Karapetsas shared lists names, home addresses, phone numbers, nationality and linked wallet addresses among the data viewed. Gnosis Pay's data guidance keeps identity and transaction records for five years after an account closes.

A bank stops a leaked card by issuing a new number. Gnosis Pay cancelled Karapetsas's card the day it found the intrusion. It cannot cancel his Safe address. Self-custody moved the funds out of the company's reach. The identity file stayed with Gnosis Pay. On a public chain, that file reveals more than a bank's customer file would. CertiK has warned, after a separate Ledger leak, that a known home address can expose a holder to physical coercion. A crypto card vendor's data retention now matters as much as who holds the keys. Every purchase made from those Safes stays on Gnosis Chain, and the stolen file puts a name on them.

Read more below!

As of 22:38 UTC, Nov. 6. Data: CoinGecko, Aave, Hyperliquid. Full list

WATCH [PARTNER]

The Hidden Bottleneck Slowing Ethereum (and How Optimum Fixed It) | MIT's Muriel Médard

MIT professor and Optimum co-founder Muriel Médard explains how Optimum speeds up block propagation on Ethereum without centralizing it, what that means for validator returns, and her plans for traders. Watch the episode.

SECURITY

Gnosis Pay Confirms Breach of Consumer-Card System

Gnosis Pay confirmed that an intruder reached its consumer-card system, detected Nov. 3, and says customer funds were unaffected. Gnosis Pay says the breach did not reach the enterprise platform behind its white-label card programs. Gnosis Pay emailed each affected customer a list of the data taken. Gnosis Pay made 3D Secure mandatory for online card payments and raised monitoring of cards and wallets until the consumer system retires on Dec. 20. The company has told data-protection authorities and its card issuer, and says it will never ask customers to move funds by email, text or phone.

Gnosis Pay Confirms Breach of Consumer-Card System

Gnosis Pay says a consumer-card breach detected Nov. 3 exposed customer information. Funds were unaffected, according to the company.

thedefiant.io

HACKS

Binance Hackers Swap $50 Million in XRP, Mostly Into Bitcoin, Elliptic Says

Elliptic says the Binance attackers swapped about $50 million of XRP, mostly through THORChain into bitcoin. Two of the six addresses that held the XRP sent funds to dozens of new accounts, which made the swaps. Bitcoin bought with converted assets reached about 1,650 BTC, or $124 million, nearly double the figure a day earlier. The main ETH and BTC holdings have not moved, and Elliptic estimates that a negligible amount has reached cash-out. Binance also asked ArbitrumDAO to release frozen ETH and ARB.

DEFI

Aave Labs Acquires Avon Team to Develop Fixed-Rate Lending

Aave Labs acquired the team and technology behind Avon to build fixed-rate lending across Aave's products. The deal covers Avon's lending protocols and its onchain order book, which matches borrowers with lender offers. Terms were not disclosed, and Aave Labs named no first market or launch date. Aave's rates move with pool usage today, so a fixed rate would let a borrower lock a cost for the loan's term. Separately, Aave DAO's Snapshot vote on Babylon native bitcoin collateral for V4 runs until 9:03 a.m. ET on Nov. 9.

SECURITY

Threshold Sets tBTC Reconnection Target as Week-Long Pause Continues

Threshold expects tBTC node operators to start reconnecting at about 7 p.m. ET on Nov. 6, subject to final security checks. Deposits, minting and bitcoin redemptions, paused since Oct. 30, resume only once enough operators are online. Threshold's explorer showed about 4,320.58 BTC in bridge wallets against 4,185.16 tBTC on Ethereum. Aave's Ethereum Core tBTC reserve, with about $123.2 million supplied, stays frozen to new deposits and borrowing. LlamaRisk says it will propose lifting those limits once bridge operations are back to normal.

SECURITY

Blockaid Warns Reth Bug Can Produce Incorrect State Proofs

Blockaid warned that a bug in the reth execution client and software built on it, including op-reth, can make nodes compute wrong state roots. Unpatched nodes may stall or return incorrect state proofs, and Blockaid reports no known loss of funds. Patched builds are reth v2.10.0, op-reth v2.8.1 and Base node-reth v1.5.3. Bridges that verify proofs rely on node answers, so RPC providers need the patch first. Gauntlet closed V1 vault supply queues to block new deposits, and LayerZero paused some routes until each chain confirms its patch.

Other Stories Worth Your Time

Ether Falls 8.5% to $2,220, Lagging Bitcoin — ether ETFs lost $99.9 million on Nov. 5, when bitcoin slid below $77,000.

Loopscale Partly Restores Loan Functions, Keeps Vault Withdrawals Frozen — Genesis Vault withdrawals stay frozen with no reopening date.

Coinbase Opens USDC Borrowing Against PAX Gold — loans run through Morpho on Base with a 77% liquidation threshold.

Ondo Plans Tokenized Anthropic Shares From IPO Day — its notes are backed by shares, unlike pre-IPO perpetuals.

Safe Says $12.4 Billion of Smart-Account Assets Sits in DeFi — that is about a fifth of the $57.64 billion in Safe accounts.

Veranta Adds 1,000x BTC and ETH Leverage on Base — a vault buffer pays winners before LP capital.

Algorand Foundation Shuts Forum and Advisory Council — staking support continues.

US Sanctions 45 More Targets Linked to Prince Group — OFAC named four people and 41 companies. Treasury and the Fed also dropped a $250 travel-rule threshold.

Crypto 401(k) Rule Enters Final White House Review — the SEC's crypto broker rule is in the same review.

Merkley-Raskin Bill Would Ban Election and Sports Contracts on US Exchanges — the March bills remain in committee.

California Tribes Win Order Barring Kalshi Sports Contracts on Their Lands — Arkansas also sued Kalshi, and Kalshi opened single-stock perpetuals.

Hyperliquid Strategies Posts $620.6 Million Profit on HYPE Paper Gains — Strive reported $474.8 million on bitcoin gains.

What Is Stablecoin Market Cap? Supply, Share and Dominance Explained — our guides also cover derivatives, clearing, Fed rates and after-hours stock tokens.

Bank of Russia Clears Bitcoin, Ether and USDT Rules for Nov. 17 — retail buyers face tests and annual limits.

Ethereum Foundation Calls for Contract Checks After Glamsterdam Security Findings — proposed gas changes break some contracts.

iPhone Wallet Theft Probe Traces $4.06 Million in TRON Drains — Trust Wallet urged iOS updates.

IREN Mining Revenue Falls 58% as AI Sales Reach $200 Million — its AI revenue target moved to early 2027.

Former FBI Agent Pleads Guilty to $2.47 Million Crypto Theft — he used credentials from bureau cases.

Extended Sets Final XTEN Airdrop Rate as Xpoints Program Ends — about 4.2857 XTEN per point.

Greek Parliament Approves 10% Tax on Crypto Gains — annual gains up to €500 are exempt.

Solana Labs’ Leap Opens iPhone Beta for Tokenized Stocks and Crypto — swaps route through Jupiter.

Anza Urges Solana Validators to Upgrade Agave Before Epoch 1079 — older versions risk a fork.

EEZ Launches Rollup X With Swaps Filled by Mainnet Liquidity — CoW Swap and Safe demos settled in one transaction.

OpenSSH Ships Urgent Workaround for Alpine Password Bypass — musl systems without PAM are affected.

Paraguay’s Peña Submits Resignation Amid Ueno Bank Crisis — Bybit USDT offers carry a 13% premium.

Floki Takes Trading Bot Offline Amid Exploit Investigation — it warns users against deposits.

SoFi Says Crypto Vendor Issue Is Delaying Deposits and Withdrawals — SOFIE redemptions go unmentioned.

Groma Launches Real Estate Issuance and Redemption on Uniswap — a permissioned Uniswap v4 pool limits access.

Zcash Nears NU7 Upgrade and Sprout Spending Cutoff — about 12,224 ZEC remain in Sprout.

Anchorage Digital Applies for CFTC Swap Dealer Registration — margin and disclosure rules would follow.

Tempo Introduces Credit Service With Unsecured Loans in Bolivia — Tala funds the USDT loans.

Canary’s Staked INJ ETF Begins Trading on Nasdaq — two fee layers cut rewards.

Lido Adds Firelight Loss Protection to Earn Vaults — market losses are excluded.

Polygon Draft Would Give Labs a New Route to Upgrade Contracts — PIP-93 adds an 8-of-11 council.

Thailand Sets Dec. 5 Bitget Block As Local Exchange Deal Awaits Approval — the SEC filed a complaint against its operator.

Binance Revokes SignalPlus API Keys After Security Warning — traders should review open orders.

France’s Budget Rejection Shelves Stablecoin Tax and Wallet Reporting — self-custody reporting is sidelined.

ZetaChain Opens Vote to Shut Down Layer 1 Around Dec. 9 — ZETA would move to Solana.

OKX–ICE Stock Venue’s Issuer Objections Reach 62 — Trump Media-linked wallets sent 4,259 BTC to Crypto.com.

Pendle Volume Hits $221.5 Million, a 30-Day High — locked value stayed flat.

Mercado Bitcoin Plans View-Only Reopening on Nov. 9 After Hack — trading stays suspended.

TSV Begins Tokenized CNTN Trades Under SEC Innovation Exemption — DRW Cumberland bought on Canton.

Crypto Groups Seek to Strike Down Illinois’ 0.2% Tax — they want more than a July 2027 delay.

Trending on The Defiant