← Gnosis Payreviewed 2026-09-07 · 24 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Gnosis Pay against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
4 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #4[disputed][awaiting moderator]in section: Overview and Background
“The service is currently available to residents of the European Economic Area and is not yet offered in the United States, Asia-Pacific, or Latin America.”
reviewerThe service is currently available to residents of the European Economic Area and is not yet offered in the United States, Asia-Pacific, or Latin AmericaThe page's own text elsewhere states GBPe is supported, and GBPe is documented (by Gnosis Pay's help center) as the stablecoin for UK and Gibraltar users — both outside the EEA — which is inconsistent with a strict EEA-only availability claim.Proposed correction (not yet applied)The service is currently available to residents of the European Economic Area, the United Kingdom, and Switzerland, and is not yet offered in the United States, Asia-Pacific, or Latin America. - #7[disputed][awaiting moderator]in section: June 2026 Zodiac Delay Module Exploit
“On June 1, 2026, blockchain security firm PeckShield detected an active exploit targeting Gnosis Pay infrastructure.”
reviewerBlockchain security firm PeckShield detected an active exploit targeting Gnosis Pay infrastructureBoth contemporaneous reporting and the later official post-mortem indicate the exploit was first identified internally (by NOCA) and publicly flagged by Köppelmann, with PeckShield amplifying rather than originating the warning; the page's framing reverses this sequence.Proposed correction (not yet applied)On June 1, 2026, Gnosis co-founder Martin Köppelmann first publicly warned of an active exploit targeting Gnosis Pay infrastructure, a warning that blockchain security firm PeckShield subsequently amplified. - #10[disputed][awaiting moderator]in section: June 2026 Zodiac Delay Module Exploit
“According to the Zodiac disclosure on June 3, 2026, the flaw was only triggered under a precise configuration: accounts where one of the vulnerable modules was enabled and where a Safe account using a vulnerable fallback handler had been assigned as a module or role member.”
reviewerThe Zodiac disclosure of the exploit's technical details occurred on June 3, 2026The page appears to have conflated the disclosure date with the June 3 publication date of the news article reporting on it; multiple sources place the actual Zodiac disclosure on June 2, 2026.Proposed correction (not yet applied)According to the Zodiac disclosure on June 2, 2026, the flaw was only triggered under a precise configuration: accounts where one of the vulnerable modules was enabled and where a Safe account using a vulnerable fallback handler had been assigned as a module or role member. - #11[disputed][awaiting moderator]in the timeline
“2026-06-03”
reviewerZodiac publicly discloses the technical details of the vulnerability on June 3, 2026Same underlying date error as the Section 2 prose finding; the timeline date field should reflect the actual disclosure date (June 2), not the date of the news article reporting on it.Proposed correction (not yet applied)2026-06-02
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #23[unverifiable][awaiting moderator]in section: Regulatory and Compliance Status
“No regulatory enforcement actions against Gnosis Pay or its parent have been identified as of June 3, 2026.”
reviewerNo regulatory enforcement actions against Gnosis Pay or its parent have been identified as of June 3, 2026This is an absence-of-evidence claim; a reasonable search turned up no enforcement action, but the underlying claim of a completely clean regulatory record cannot be fully verified against every relevant regulator.
stale
2 claimsThe claim was accurate when written but events since have overtaken it.
- #8[stale][awaiting moderator]in section: June 2026 Zodiac Delay Module Exploit
“The total financial losses from the exploit had not been publicly disclosed as of June 3, 2026.”
reviewerThe total financial losses from the exploit had not been publicly disclosed as of June 3, 2026True as of the June 3, 2026 snapshot, but superseded by Gnosis Pay's own subsequent post-mortem disclosure of exact loss figures.Proposed correction (not yet applied)Gnosis Pay's official post-mortem later disclosed that attackers extracted approximately $1.5 million, with an additional roughly $300,000 rendered inaccessible, for total losses of approximately $1.8 million across 5,281 wallets. - #9[stale][awaiting moderator]in section: User Compensation and Service Recovery Plan
“The total cost of the reimbursement commitment had not been publicly disclosed as of June 3, 2026, as the total amount drained remained undisclosed.”
reviewerThe total cost of the reimbursement commitment had not been publicly disclosed as of June 3, 2026, as the total amount drained remained undisclosedSame underlying fact as the Section 2 finding — the amount drained and reimbursement scope have since been disclosed by Gnosis Pay's official post-mortem.Proposed correction (not yet applied)Gnosis Pay's official post-mortem later disclosed total losses of approximately $1.8 million (about $1.5 million stolen plus roughly $300,000 rendered inaccessible), all of which Gnosis absorbed, restoring 100% of affected user funds.
partially supported
5 claimsThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in section: Overview and Background
“As of December 2025, Gnosis Pay had processed approximately $131 million in card spending and over 1.6 million transactions, with 50,000 or more active accounts.”
reviewerAs of December 2025, Gnosis Pay had processed approximately $131 million in card spending and over 1.6 million transactions, with 50,000 or more active accountsThe $131M spending figure is corroborated directly from the cited tweet. The transaction count and active-account figures could not be located in the cited source (direct fetch was blocked, HTTP 402), and Gnosis's own year-in-review blog implies a higher transaction count (2 millionth payment by December) than the 1.6 million stated on the page. - #6[partially supported][awaiting moderator]in the timeline
“Gnosis founded by Martin Köppelmann and Stefan George under ConsenSys, initially focused on prediction markets.”
reviewerGnosis founded by Martin Köppelmann and Stefan George under ConsenSys, initially focused on prediction marketsThe ConsenSys origin and prediction-market focus are accurate, but the founder list omits Friederike Ernst, who is credited as a co-founder in independent sources. - #12[partially supported][awaiting moderator]in section: June 2026 Zodiac Delay Module Exploit
“The incident was declared fully contained by June 2, 2026.”
reviewerThe incident was declared fully contained by June 2, 2026Contemporaneous sources describe the exploit as being brought under control rather than officially declared 'fully contained'; the stronger wording appears to be the page's own characterization rather than a direct claim from cited sources. - #13[partially supported][awaiting moderator]in the timeline
“Gnosis declares the exploit fully contained. Recovery plan announced: all users to receive new card-linked Safe wallets; affected users' new accounts to be preloaded with pre-exploit balances. Phased service restoration planned beginning Wednesday evening (CEST).”
reviewerGnosis declares the exploit fully contained (timeline entry dated 2026-06-02)Same overstatement of containment status as the corresponding Section 2 prose. - #14[partially supported][awaiting moderator]in section: June 2026 Zodiac Delay Module Exploit
“Köppelmann stated: 'Most users will not be able to withdraw funds, but we are actively working to contain the damage. We believe we can contain the majority of it, and in any case, we will ensure that all users are made whole.'”
reviewerKöppelmann stated: 'Most users will not be able to withdraw funds, but we are actively working to contain the damage. We believe we can contain the majority of it, and in any case, we will ensure that all users are made whole.'The substance of both statements is accurate, but they are combined into a single blockquote with altered wording, which misrepresents them as one uninterrupted remark.
confirmed
12 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Overview and Background
“The legal entity, Gnosis Pay Co Ltd, was incorporated on June 7, 2023, in London, United Kingdom (Companies House number 14919639), with a registered address at 12 New Fetter Lane, London, EC4A 1JP.”
reviewerGnosis Pay Co Ltd was incorporated June 7, 2023 in London, Companies House number 14919639, registered address 12 New Fetter Lane, London, EC4A 1JPCompanies House number, incorporation timeframe and UK jurisdiction are corroborated by independent search results referencing the same company record. - #2[confirmed][no action needed]in section: Overview and Background
“The card is issued by Monavate Limited, an Electronic Money Institution authorized and regulated by the UK Financial Conduct Authority (FRN: 901097) under the Electronic Money Regulations 2011, pursuant to licence by Visa Europe Limited.”
reviewerGnosis Pay's card is issued by Monavate Limited, an FCA-regulated EMI (FRN 901097) under the Electronic Money Regulations 2011, via a Visa Europe licenceRegulatory arrangement matches multiple independent sources describing Gnosis Pay's card-issuing structure. - #5[confirmed][no action needed]in section: Overview and Background
“The platform supports stablecoins including EURe and GBPe, and rewards users with 1–5% cashback denominated in the GNO governance token.”
reviewerThe platform rewards users with 1-5% cashback denominated in the GNO governance tokenCashback range and EURe/GBPe stablecoin support are both independently corroborated. - #15[confirmed][no action needed]in section: June 2026 Zodiac Delay Module Exploit
“The GNO token experienced significant market volatility: its price initially spiked to approximately $132.10 before reversing to approximately $107.40, registering an intraday loss of approximately 7%, with 24-hour trading volume rising over 1,000% to roughly $18.8 million.”
reviewerGNO price spiked to approximately $132.10 before reversing to approximately $107.40, an intraday loss of approximately 7%, with 24-hour trading volume rising over 1,000% to roughly $18.8 million (Section 2)Price, percentage-decline, and volume figures all match the cited source precisely. - #16[confirmed][no action needed]in section: GNO Token Market Impact
“GNO's price initially spiked to approximately $132.10 before reversing sharply to approximately $107.40, representing an intraday decline of approximately 7%. Market capitalization dropped to approximately $287.4 million at the low, while 24-hour trading volume surged approximately 1,043% to roughly $18.8 million.”
reviewerFollowing disclosure, GNO spiked to ~$132.10 then fell to ~$107.40 (~7% intraday decline), market cap dropped to ~$287.4 million, and 24h volume surged ~1,043% to ~$18.8 million (Section 7)All figures independently corroborated; this is the same data point restated in a second section, sourced consistently. - #17[confirmed][no action needed]in section: Prior Security Incidents
“In late May 2026, a separate exploit targeting the SquidRouterModule drained approximately $3 million from 86 Gnosis Safe wallets on Ethereum and Base networks. All stolen tokens in that incident were swapped to DAI via attacker-controlled Uniswap v3 pools, as reported by blockchain security firm Blockaid.”
reviewerIn late May 2026, a separate exploit targeting the SquidRouterModule drained approximately $3 million from 86 Gnosis Safe wallets on Ethereum and Base, with stolen tokens swapped to DAI via attacker-controlled Uniswap v3 pools, per BlockaidThe claim itself is well corroborated by independent reporting and the Blockaid on-chain source, but one of the section's cited secondary sources (Bitget/TesseraDAO article) does not actually discuss the SquidRouterModule incident and appears to be a mismatched citation. - #18[confirmed][no action needed]in the timeline
“Approximately $3 million drained from 86 Gnosis Safe wallets on Ethereum and Base via a separate SquidRouterModule exploit; all stolen tokens swapped to DAI via attacker-controlled Uniswap v3 pools.”
reviewerApproximately $3 million drained from 86 Gnosis Safe wallets on Ethereum and Base via SquidRouterModule exploit, tokens swapped to DAI via Uniswap v3 (timeline, dated 2026-05-25)Date and details match independent reporting closely. - #19[confirmed][no action needed]in section: Technical Architecture and Modular Risk
“Safe Labs confirmed that Safe smart contracts, Safe{Wallet} infrastructure and user interface, and account recovery systems were not affected by the exploit.”
reviewerSafe Labs confirmed Safe smart contracts, Safe{Wallet} infrastructure/UI, and account recovery systems were not affected by the exploitDirect quote match confirmed. - #20[confirmed][no action needed]in section: Technical Architecture and Modular Risk
“Zodiac stated that over 95% of identifiable affected accounts had taken corrective action by June 2, 2026, and that a full post-mortem would be published once the investigation was complete.”
reviewerOver 95% of identifiable affected accounts had taken corrective action by June 2, 2026, with a full post-mortem pendingThe >95% figure is a direct match; the underlying disclosure date issue is addressed separately under the zodiac-disclosure-date defect group. - #21[confirmed][no action needed]in section: June 2026 Zodiac Delay Module Exploit
“the flaw was only triggered under a precise configuration: accounts where one of the vulnerable modules was enabled and where a Safe account using a vulnerable fallback handler had been assigned as a module or role member”
reviewerThe flaw was only triggered where a vulnerable module was enabled and a Safe account using a vulnerable fallback handler had been assigned as a module or role memberTechnical configuration description matches the source closely. - #22[confirmed][no action needed]in section: June 2026 Zodiac Delay Module Exploit
“Monerium, the issuer of EURe, confirmed that the vulnerability was specific to Gnosis Pay's delay module infrastructure and did not affect EURe itself or Monerium's systems.”
reviewerMonerium confirmed the vulnerability was specific to Gnosis Pay's delay module infrastructure and did not affect EURe itself or Monerium's systemsDirect match to the cited official statement. - #24[confirmed][no action needed]in section: June 2026 Zodiac Delay Module Exploit
“The Delay Module is intended to impose a roughly three-minute waiting period between transaction approval and execution, giving users time to detect and cancel unauthorized activity.”
reviewerThe Delay Module is intended to impose a roughly three-minute waiting period between transaction approval and executionIndependently corroborated description of the Delay Module's intended function and duration.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.