Gnosis Pay said a software flaw dating to October 2023 allowed a $1.5 million exploit of its card safe infrastructure and that all affected users have been reimbursed. The vulnerability, identified in version 3.4.0 of the Zodiac smart contract framework, remained undiscovered since Oct. 30, 2023, and was exploited on June 1. Monitoring systems operated by treasury manager NOCA detected the first unauthorized transfer at 06:17 UTC on June 1. Engineers identified the root cause within two hours and suspended card services, temporarily halted the bridge to Gnosis Chain, and provided attacker wallet addresses to stablecoin issuers to aid tracing. Gnosis Pay notified other projects that could have been exposed. Recovery efforts restored access in phases; new card‑safe modules were deployed, allowing the first affected accounts to regain balance and payment‑card functionality by the night of June 3. Service was restored for 99 % of users by June 6, with the remaining accounts recovered shortly afterward. The company absorbed the financial loss itself, resulting in no loss for customers. Approximately $300,000 of assets have not yet been recovered, and recovery efforts are ongoing. The postmortem disclosed that 5,281 wallets holding at least $1 were affected and that the stolen assets included GNO, EURe, USDC.e, and other digital tokens. Gnosis Pay published the attacker’s wallet address, 0x5a7…7a35, and noted that the exploit targeted the Delay Module and the Roles Module within its card safe infrastructure. The disclosure follows other security events in the crypto sector, including a $36 million exploit at Humanity Protocol that accelerated its restructuring and its shift toward enterprise artificial intelligence products, as stated by founder Terence Kwok. G7 leaders also issued a joint statement calling for coordinated action against North Korea’s cryptocurrency thefts and cybercrimes, linking stolen digital assets to financing of nuclear and missile programs.