Argentina
E-commerce / Crypto Hardware
Selling
Argentine Hardware Wallet Retailer Allegedly Exposed, Linking Named Buyers to Home Addresses and ID Numbers
A forum user posting as kingloki is offering what they describe as a complete order export from coincustody.io, an Argentine reseller of Trezor and Ledger hardware wallets, covering 212 orders placed between May 2025 and August 2026. The record count is small, but the composition is unusually dangerous: the seller claims 107 customer emails, 70 DNI and CUIT identity numbers, 47 full street addresses with apartment numbers, and 34 phone numbers, each tied to a named buyer and the specific device they purchased. Also claimed are payment identifiers, browser IP addresses and live parcel tracking links. Buyers are said to include corporate and foreign customers. The claim is unverified.
▣Post details
Argentina!Allegedly included
- Customer full names
- DNI and CUIT numbers
- Home street addresses
- Apartment and postal codes
- Phone numbers
- Email addresses
- Payment transaction IDs
- Browser IP addresses
- Live parcel tracking links
- Exact device models bought
- Order values and dates
- Payment method used
- Courier and delivery data
- Corporate and foreign buyers
◱Screenshots
⚠Potential impact
The record count badly understates this one. What the set reportedly establishes is that a named person at a specific home address, with a verified national ID and a working phone number, took delivery of a device whose only purpose is storing cryptocurrency. That is a targeting list before it is a privacy incident, and the risk is physical as much as digital: coercive home robbery against known holders is a recurring pattern in the region. The digital exposure is severe on its own, since knowing the exact wallet model and purchase date makes a fraudulent firmware or security notice highly credible, and the goal of such messages is the recovery phrase, which surrenders the funds outright. The DNI and phone pairing additionally supports identity fraud and SIM swapping. Live courier tracking links raise the further prospect of interception while orders are still in transit.
iStatus
UnverifiedThe post describes read access to an order interface rather than an intrusion, and the export is consistent with a standard storefront order pull, which points to an exposed token or misconfigured endpoint. The claim is unusually checkable given its size, and the individuals named in the samples could confirm their own records, though that is a burden falling on them rather than on the retailer. The seller notes buyers in the European Union and Uruguay, which would engage obligations beyond Argentina's data protection law. Dark Web Informer is not reproducing the sample records, which contain complete identities, nor the contact route. The same account is separately advertising paid intrusion services. The claim is unverified and the retailer has not publicly addressed it.
DARK WEB INFORMER - THREAT INTELLIGENCE
