Users of Gnosis Pay, the crypto payment card platform within the Gnosis ecosystem, have been urged to withdraw all funds immediately after blockchain security firm PeckShield detected an active exploit. The alert, disclosed on June 1, 2026, revealed a vulnerability in the platform's delay module—a feature designed to add an extra layer of security to transactions.
Gnosis co-founder Martin Köppelmann publicly reinforced the warning, tweeting that a bug in the delay module could affect holders of both GNO, the ecosystem's native token, and EURe, a euro-backed stablecoin. He advised users to move all EURe and GNO from Gnosis Pay to secure, self-custodial wallets as a precaution.
PeckShield's report suggests the vulnerability may already be exploited by attackers, though the Gnosis team has not yet confirmed the scale of the attack or the amount of funds potentially compromised. The lack of immediate technical details has left the community waiting for a formal post-mortem, but the urgency of the co-founder's message underscores the severity.
The incident highlights ongoing risks in custodial elements of crypto payment platforms, even those built on decentralized infrastructure. Independent security researchers like PeckShield continue to play a critical role in identifying and publicizing threats. Users are advised to monitor official Gnosis channels for further updates and to prioritize asset safety by following the withdrawal recommendation.
