The card file had the wallets

The public letter will not name the fields. The inbox did.

Gnosis Pay’s 6 November post — still the letter this evening — says monitoring caught unauthorised access on 3 November against the system that runs Gnosis Pay-branded cards. Containment in two hours. Credentials rotated. The hole closed. Funds, it says, did not move. The enterprise platform that issues other people’s cards was not in it. That B2C stack was already due to die on 20 December. 3-D Secure is now mandatory on every online charge until then. They mailed each affected person “exactly what information was taken from their account.” They have not published a count, or a field list, on the page.

The mails are not one file. Some people, as Protos read the screenshots, got the name on the card, a shipping address, an account reference. Others, including notices Cointelegraph reviewed, got a full PAN, expiry, CVV, home address, the wallets linked to the account, mail, phone, nationality, and in some cases an IBAN. That join — a door and a chain address — is the incident. A cancelled card on the 3rd is not a finding that the PAN came back.

A seed-phrase check, a “re-verify the wallet,” a move-the-funds text that already knows last Tuesday’s coffee, is not them. They said they will not ask.

What the card file will be asked to cover

It will be briefed as every Gnosis Pay partner emptied, and as every wallet on Gnosis. It is the branded-card stack. White-label is out. It will be briefed as a drain. Funds, they say, did not move. Do not add Binance’s 7702 afternoon, or Polymarket’s RUM script. Different weeks. Different trust.

If you got the mail, the fields in it are the file. If you only held a partner card, you are not in this letter until they put you in. The retirement date is not a containment. It is a calendar.

The card file had the wallets. That is the row a phishing desk wanted.