8 min read
The Gnosis Pay breach, detected on November 3, exposed card numbers, home addresses and linked wallets. If you hold a crypto card, that’s the incident to act on this week. It came alongside new laundering moves from the $6.34 billion Binance hack and a withdrawal and trading freeze at South Korean exchange Gopax. Below I cover what happened in each case and the checklist I’d work through today.
Key takeaways
- Gnosis Pay detected unauthorized access to its consumer card system on November 3 and disclosed it on November 6. Customer funds were not affected, the company says.
- Binance puts the October 29 theft at $6.34 billion and says it has frozen or intercepted about $2.85 billion, per Bitcoin Magazine.
- Elliptic says attackers had swapped about 42 million XRP (roughly $50 million) into bitcoin, mostly through THORChain, and about 192 million XRP was still unswapped.
- Gopax halted standard deposits and withdrawals at 2:55 p.m. local time on November 6 after a hacking threat email. No losses have been reported so far, per Bitcoin Magazine.
What leaked in the Gnosis Pay breach
Gnosis Pay issues crypto-linked Visa debit cards. The company says its monitoring caught unauthorized access to its consumer card system on November 3 and containment began within two hours. It disclosed the incident on Friday, November 6.
CoinDesk reports that the exposed details include home addresses, card numbers and linked crypto wallet addresses. Rotki founder Lefteris Karapetsas said publicly that his name, full home address, card number and every linked wallet address were in the data.
Cointelegraph reviewed the breach notifications sent to customers, and its list is longer. It includes full card numbers with expiration dates and CVV codes, names, home addresses, emails, phone numbers, nationalities, linked wallet addresses and, in some cases, IBAN and BIC banking details.
Gnosis Pay hasn’t said how many customers were affected. To give a rough sense of scale, Cointelegraph cites OpenRate data showing about 2,400 daily active cardholders.
What Gnosis Pay says it has fixed
The good news is limited, but it’s real. The company says customer funds were not affected. Its separate enterprise platform, which runs white-label card programs for fintechs, wallets and neobanks, was not touched.
It replaced the compromised credentials, fixed the vulnerability and made 3D Secure mandatory for online card payments. Decrypt reports that it also notified its card issuer and data protection authorities. The consumer card system was already due to be retired on December 20.
Why a crypto card leak is worse than a bank card leak
When a bank card leaks, you cancel it and get a new one. This leak is more serious. It pairs your card with your home address and your wallet addresses, and anyone can paste those addresses into a block explorer and see roughly what you hold. Decrypt cites Chainalysis figures showing more than $30 million stolen in physical “wrench attacks” on crypto holders in the first half of 2026.
I’d also expect a wave of phishing. Gnosis Pay itself warned that scammers could use real personal details and past purchases to make fake messages look genuine. It says it will never ask for seed phrases, PINs or full card numbers, and it will never ask you to move funds.
Where is the stolen Binance hack money going?
In dollar terms, Binance is still the bigger story. According to Bitcoin Magazine, Binance puts the October 29 theft at $6.34 billion.
Five hot wallets sent 233.46 million XRP to an attacker address between 20:05 and 20:09 UTC. The FBI attributes the campaign to North Korea’s TraderTraitor group. Binance says it is covering customer losses from its own funds and has been reopening withdrawals in stages.
This week’s new detail comes from blockchain analytics firm Elliptic. Starting on the afternoon of November 5, the attackers split the XRP across dozens of fresh accounts and swapped it into bitcoin, mostly through THORChain. The table below shows where things stood as of Elliptic’s update, along with TRM Labs’ freeze figures.
| Binance hack metric | Amount | Source |
|---|---|---|
| Total stolen (October 29) | $6.34 billion | Binance, via Bitcoin Magazine |
| XRP drained from five hot wallets | 233.46 million XRP | Bitcoin Magazine |
| Frozen or intercepted by Binance | About $2.85 billion | Binance, via Bitcoin Magazine |
| XRP swapped to bitcoin so far | About 42 million XRP (roughly $50 million) | Elliptic |
| XRP still unswapped | About 192 million XRP (roughly $226 million) | Elliptic |
| Total bitcoin converted from the theft | About 1,650 BTC (around $124 million) | Elliptic |
| Still in linked addresses | About $3.11 billion, mostly ETH and BTC | Elliptic |
| USDT frozen by Tether, 37 minutes after the sweep | 971.1 million USDT | TRM Labs |
| Stablecoins frozen by issuers combined | About $2.67 billion | TRM Labs |
The route makes sense once you know that Tether and Circle froze large stablecoin tranches on October 29. Whatever could be frozen got frozen, so the attacker moved into assets that can’t be.
Why TRM Labs calls the Binance hack cyber war
In a Cointelegraph interview, TRM Labs executive Ari Redbord called the theft cyber war. He argued that governments should go after North Korean hackers directly, along with the laundering networks and banks they use to cash out.
For you, the important part is how the attack started. Binance’s November 3 postmortem, as Cointelegraph summarized it, says attackers posed as recruiters and planted malware on an engineer’s work computer. They then used a compromised internal AI tool to reach the wallet-signing service.
So a convincing job offer was the way in. The same trick works on individuals. The stakes are just smaller.
Why did Gopax pause withdrawals?
Bitcoin Magazine reports that on Friday, November 6, Gopax halted standard deposits and withdrawals at 2:55 p.m. local time. It stopped trading at 3:53 p.m. and canceled all open orders.
The trigger was an email from someone who claimed they could hack the exchange. A Gopax official told Yonhap the threat had not been verified, and no losses have been reported so far.
Gopax says it is moving all virtual assets into cold wallets. Deposits were later reported as restored. Web and app withdrawals stayed closed, though, and customers were told to request withdrawals through the support center for manual processing. No date has been set for trading to reopen.
A separate account-access incident, ongoing since September, leaked data on seven customers and two current or former employees. Gopax treats it as unrelated. My read is that moving everything to cold storage is a cautious step and doesn’t signal a loss. Users still pay for it, because anyone who needed to move funds that Friday afternoon couldn’t.
How the three incidents compare for card and exchange users
Here’s where users stand, based on what each company has said.
| Incident | What was hit | User funds (company says) | Main risk for you now |
|---|---|---|---|
| Gnosis Pay | Consumer card system: card data, addresses, wallet addresses | Not affected | Targeted phishing, card fraud, being identified as a holder |
| Binance | Hot wallets, $6.34B stolen on Oct. 29 | Losses covered from Binance’s own funds | Fake “recovery” or “refund” scams riding the headlines |
| Gopax | Threat email; no breach of funds confirmed | No loss reported so far | Funds stuck while web and app withdrawals are paused |
How to protect your crypto after a data breach
You don’t need to panic. You need about an hour of housekeeping. Here it is, roughly in order of payoff.
- Treat every message about your card as fake until you’ve checked it yourself. After a leak, a scammer may know your name, your address and even your recent purchases, so a text that quotes a real transaction proves nothing. Open the app or type the website address yourself. Don’t tap the link.
- Watch for address poisoning before every transfer. Once attackers know your wallet addresses, they can send tiny transactions from lookalike addresses that share the first and last few characters, hoping you’ll copy the wrong one from your history. Use a saved address book and compare the full string.
- If you got a Gnosis Pay notice, ask about cancelling or replacing your card and keep an eye on your statements. Cointelegraph saw one notification saying a customer’s card had already been canceled on November 3, with no suspicious transactions detected.
- Keep long-term holdings in self-custody. A hardware wallet means an exchange freeze can’t touch them, but the responsibility moves to you. Write the seed phrase down offline and never type it into a website. Buy the device directly from the manufacturer: Decrypt mentions a suspected $87 million drain linked to Ledger devices bought from a third-party seller.
- Switch exchange 2FA to a hardware security key or passkey. SMS codes can be hijacked with a SIM swap, and Cointelegraph lists phone numbers among the Gnosis Pay data. A FIDO2 key will also refuse to log in on a lookalike phishing domain. SMS and app codes can’t do that.
- Revoke token approvals you no longer use. Revoke.cash or your block explorer’s approval checker will list every contract allowed to spend your tokens. Each revocation costs a small gas fee and shuts a door that drainer sites depend on.
- Keep your identity separate from your savings. A fresh wallet that has never been linked to your name, card or exchange account is much harder to trace back to you. Don’t talk about your holdings on social media.
- Be suspicious of recruiters and “test tasks.” The Binance breach started with a fake recruiter. Never run files or code from a job offer on a computer that also holds wallets or exchange logins.
What I’m watching next
For Gnosis Pay, I want the number of affected customers, and I want to know whether cards get reissued before the consumer system shuts down on December 20. For Binance, the question is whether the remaining 192 million or so XRP takes the same THORChain route, and how much of the roughly $3.11 billion in linked addresses can still be frozen. For Gopax, I’m waiting for the date web and app withdrawals and trading come back.
Nobody knows yet whether the Gopax threat was real or a bluff. The checklist above protects you either way, and it covers all three kinds of failure. None of this is financial advice, so do your own research before you move funds.
FAQ
Were Gnosis Pay customer funds stolen?
Gnosis Pay says customer funds were not affected. The breach exposed personal and card data from its consumer card system. The company hasn’t said how many customers were hit.
What should I do if my data was in the Gnosis Pay breach?
Ask about cancelling or replacing your card, keep an eye on your statements, and treat any message that mentions your card or purchases as suspicious. Your wallet addresses may now be known, so check the full address before every transfer.
Is my money safe on Binance after the hack?
Binance says it is covering customer losses from its own funds and has been reopening withdrawals in stages. Watch out for anyone offering to “recover” funds for you. That’s a common follow-up scam.
When will Gopax reopen withdrawals and trading?
No date has been set. In the latest reports, deposits were restored but web and app withdrawals were still closed, and support was processing withdrawal requests by hand. No losses have been reported so far.
Related reading
This article is for information only and is not financial advice. Crypto assets are volatile; you can lose all of your money.