Track market-moving stories before they get noisy

On 1 June 2026, attacker(s) exploited a vulnerability that directly affected software modules (Delay Module & Roles Module) used in connection with the Gnosis Pay card safe infrastructure. This resulted in certain user safe wallets, and the funds stored there, either being compromised or at risk of compromise.

The team quickly contained the issue, taking card services offline and co-ordinating with partners to isolate attacker accounts, while keeping partners and users informed, and guaranteeing user funds.

The attacker(s) were able to extract a total of $1.5m. An additional ~$300k was rendered inaccessible and we are exploring recovery options.

Gnosis absorbed the losses and all funds were restored to users.

The TimelineWhenWhat1 Jun 2026

Monitoring flagged the attacker's first large unauthorized transfer at 06:17 UTC and, following verification, the emergency response was initiated.

Root cause identified as a vulnerability in the Zodiac modules at 08:06 UTC.

1 Jun 2026

Card services taken offline. Bridge to Gnosis Chain paused by bridge validators. Attacker-linked addresses shared with stablecoin issuers to isolate where possible.

1–2 Jun 2026

Gnosis leadership proactively notified external projects that were at risk from the same vulnerability.

The Zodiac modules were repaired and shared with ChainSecurity for a focused review.

3 Jun 2026

On the evening of Wednesday, June 3rd, the first accounts were reactivated, including account balance restoration, card re-enabling, and resumption of normal operations.

An emergency fund was established and made available for users in extremis.

4 Jun 2026

ChainSecurity completed their review, the modules were also reviewed by internal teams, and we began the phased resumption of services.

4–7 Jun 2026

We deployed newly engineered card safe modules in tranches, linking to users' existing profiles. This was followed by phased restoration of full account balances and resumption of normal services.

6 Jun 2026

Full services restored to 99% of users, with the remaining accounts restored early the following week.

No users lost funds in the exploit.

Description of the ExploitThe attack was rapidly detected by treasury manager, NOCA, via their monitoring infrastructure. We immediately triggered our incident response protocol and identified the root cause within 2 hours.

The impact was isolated to the card safe software module components (specifically the Delay and Roles Modules provided by Zodiac). To ensure containment during the active triage phase, we systematically paused card transaction processing, authorisation systems, and new user onboarding.

To let an account owner move funds without holding native gas tokens, the account confirms requests with a signature check. It uses a standard method, ERC-1271, which asks a contract a yes-or-no question: is this signature valid?

The check read the answer the contract returned. It did not check whether the call had succeeded. Attacker(s) could deploy a contract that fails on purpose while still returning the "valid" code. To the account, a forged approval looked real. That let the attacker(s) queue withdrawals from accounts they did not own.

The vulnerability entered the Zodiac code in version 3.4.0, released on 30 October 2023, when signature support was added (commit 9a9e380).

The flawed check worked like this:

The fix is small. Also require the call to succeed:

The initial exploit contract is verifiable here: 0x5a77953caa27ed4638f4dfdc665b8064d0e97a35.

A signature patch was flagged as a security fix by the Zodiac team on 5 June 2026 (days after the exploit began).

The Amounts InvolvedAmountTaken by the attacker(s)

~$1.5M

Funds in inaccessible accounts

~$300k

Total

~$1.8M across 5,281 wallets with balance ≥ $1

Assets taken by the attacker(s):

AssetTaken (USD value)GNO

641,159

EURe

453,175

USDC.e

399,121

SAFE

2,202

WETH

323

xDAI

135

USDC

28

USDT

7

Total

~1,496,151

Actions Now UnderwayGrowing the security team.

We are growing the security team and bringing in external researchers to work alongside them, adding dedicated capacity.

Conducting a full internal review of our security practices.

We have an ongoing review of onchain and offchain systems: smart contracts, infrastructure, processes, and dependencies we rely on.

Completing an independent, holistic security assessment.

We are re-assessing our codebase and infrastructure end-to-end with an external security firm, giving us an outside perspective.

Widening our audit scope.

We have extended our smart contract audits to also cover external contracts we depend on.

Actively monitoring dependencies.

We actively monitor the dependencies we rely on, with a clear process to review and act on upstream security fixes quickly.

Rolling out the new Gnosis Pay product (known internally as v2).

We recently completed a full rebuild of the Gnosis Pay product and it is optimized for observability and streamlined operations. That observability ensures our ability to respond rapidly in future.

Gnosis Pay

Jun 23, 2026

by Alexandru Popescu

MiniPay, Opera's self-custodial stablecoin wallet, has launched the MiniPay Card: a digital Visa debit card powered by Gnosis Pay. Eligible users can now spend their stablecoin balances across Europe (EEA), Africa, Latin America and Southeast Asia at more than 175 million Visa merchant locations worldwide. Gnosis Pay manages the card program behind it.

MiniPay already had the wallet, the users, and the balances. What its users did not have was a way to spend those balances at a normal checkout. Gnosis Pay closes that gap. We built the card program so a wallet can connect its stablecoin balances to Visa without becoming a card issuer, a bank, or a payments company itself.

The last meter problemIn a lot of markets, people already save and get paid in digital dollars. Holding stablecoins is solved. Spending them is the hard part.

A balance sitting in a wallet does not pay for groceries, a bus fare, or a subscription. To do that, the money has to reach a merchant through rails the merchant already accepts. For most of the world, that means Visa. Friederike Ernst, co-founder of Gnosis, puts it this way:

"For someone in Lagos or Nairobi who already holds savings in digital dollars, the missing piece isn't the wallet. It's the last meter. The ability to spend those balances at a checkout in another country without the merchant needing to know or care about crypto."

The last meter is the distance between a stablecoin balance and a card terminal. It is short, and it is where most stablecoin products stop. The MiniPay Card covers it.

What the MiniPay Card isThe MiniPay Card is a digital Visa debit card that lives inside the MiniPay wallet. Users add it to Apple Pay or Google Pay and spend with a tap, online or in person, anywhere Visa is accepted. The balance in the wallet is the balance on the card.

Behind the familiar card experience sits a stablecoin card program. When a user taps, their stablecoin balance is settled to Visa in real time, and the merchant is paid in their local currency. The merchant sees a normal Visa payment.

How Gnosis Pay powers itGnosis Pay is the card program manager for the MiniPay Card. That means we handle the technical layer that turns a wallet balance into a working card, and we coordinate the regulated parts of the stack rather than performing them ourselves.

Here is how the pieces fit:Issuing. The card is issued through Monavate's regulated card issuing, on Visa's global network. Gnosis Pay is the program manager around that.

Settlement. When the card is used, the stablecoin balance is bridged to Visa in real time. The merchant receives local currency with no crypto-specific setup.

Self-Custody. Funds stay in the user's self-custodial wallet until the moment of spending. MiniPay users keep control of their balances.

Onboarding. A wallet that already has users can pass its existing user base and verification into the program, rather than starting from zero.

This is the work that usually takes a wallet many months to assemble piece by piece: an issuer relationship, a Visa program, settlement, and the compliance coordination to run it across markets. Gnosis Pay packages it so a fintech, neobank or wallet can ship the card instead of building a card company.

Key takeaway: As the card program manager, Gnosis Pay connects a wallet's stablecoin balances to Visa in real time, so the merchant gets paid in local currency and never has to know crypto was involved.

Who it is forThe MiniPay Card launches into an existing base. Since 2023, MiniPay has grown to more than 16 million activated wallets, with strong adoption across Africa and other high-growth regions. The card is available to eligible users in selected markets across Europe (EEA), Africa, Latin America and Southeast Asia, anywhere Visa is accepted.

It also builds on what MiniPay already shipped. After introducing Virtual Bank Accounts, which let users receive money straight into their wallets as stablecoins, the card adds the other half: a way to spend those balances online and in person. Money in, money out, in one wallet.

Why this matters beyond MiniPayMiniPay is one wallet. The pattern is the point. Any wallet or fintech with users and stablecoin balances faces the same last meter, and the same choice: build a card company, or plug into a card program that already runs. Gnosis Pay is built for the second path. We did the same integration work for MiniPay that any partner would do, making this launch a template for future wallet integrations.

It also fits how Gnosis thinks about money. Stablecoins should work like money, which means they have to be spendable. A balance you can hold but not spend is a savings account with extra steps. A balance you can tap at any Visa terminal is closer to the thing money is supposed to be.

Tip: If you run a wallet or a fintech, the rails behind the MiniPay Card are the same ones you integrate with Gnosis Pay. The build starts in the docs.

Availability, fees, and rewardsThe MiniPay Card is launching to eligible users in selected markets. Find details on availability and product features at minipay.to/virtual-card.

Fees. No monthly or annual fee. Transactions carry a low nominal FX fee and ATM withdrawal fee.

Wallet integration. The card works with Apple Pay and Google Pay for contactless payments.

Rewards. In selected markets, the card offers cashback in digital assets, including Tether Gold (XAUt0), USDT and USDC.

This launch continues the path Gnosis Pay has been on, from remittances to retail: making stablecoin balances usable in the places people spend. It is also a working example of the ownership-first model we have been building toward, where users keep custody and still get the convenience of a card.

FAQWhat is the MiniPay Card?

The MiniPay Card is a digital Visa debit card inside Opera's MiniPay wallet. It lets eligible users spend their stablecoin balances at over 175 million Visa merchants, online or in person.

Where can you use the MiniPay Card?

It is available to eligible users in selected markets across Europe (EEA), Africa, Latin America and Southeast Asia, and it spends anywhere Visa is accepted.

Do you need crypto knowledge to use the MiniPay Card?

No. Users add the card to Apple Pay or Google Pay and tap to pay. It spends like any other contactless Visa card.

How is the MiniPay Card different from a regular debit card?

It spends from your own self-custodial stablecoin balance instead of a bank account. You keep custody of your funds until the moment you tap.

Do merchants need to accept crypto?

No. Merchants are paid in their local currency and see a normal Visa payment. They do not need to accept crypto or set anything up.

Build your card programThe last meter is closed for 16 million wallets. The next ones are the wallets and fintechs that have not shipped a card yet, and the rails are ready for them.

If you are building one, book a demo or learn more on gnosispay.com.