19-08-26, 05:37 AM
coincustody.io 212 Orders Crypto Hardware Wallet Buyers EXPOSED DNI + Addresses + Phones
About the leak:
coincustody.io an Argentine online retailer of Trezor and Ledger hardware wallets Full read access to 212 customer orders spanning every purchase from May 2025 through August 13, 2026.
Inside:
107 unique customer email addresses, 70 unique DNI/CUIT numbers (Argentine national ID / tax identification), 47 full street addresses with apartment numbers and postal codes, 34 unique phone numbers, 25 live parcel tracking URLs, 88 payment IDs, and customer browser IPs. Every record ties a real customer — name, email, phone, home address, and ID number to a specific order, payment method, and order value.
The buyers are crypto users. This is a store that sells Trezor Safe 3, Trezor Safe 5, Trezor Model One and Model T, Ledger Nano X, Ledger Nano S Plus, Ledger Stax and Ledger Flex, plus accessories. Every customer in this database has proven they hold — or are about to hold — cryptocurrency on a hardware wallet. That makes this customer list one of the highest-value phishing demographics on the planet: fake firmware updates, fake "security alert" emails, recovery phrase harvesters.
The irony writes itself. Customers bought hardware wallets to protect their crypto — and the store left their names, home addresses, and ID numbers open to anyone who knows how to send an HTTP request.
Most customers are private individuals in Buenos Aires (CABA, Palermo, Almagro, Belgrano, Flores), La Plata, Córdoba, Mendoza, Mar del Plata, Quilmes, Yerba Buena and San Francisco Solano. The base also contains corporate and foreign accounts: an ExxonMobil employee, Argentina's Establecimiento Las Marías (yerba mate producer), a Uruguayan buyer, and EU-based customers (ProtonMail/Proton, OpenZeppelin email domain) — which makes this a GDPR event on top of Argentina's Ley 25.326.
Format:
Full Shopify order database export (CSV, 278 records across 3 order API pulls) Unique Orders: 212 (order numbers 1873 – 2231) Paid Orders: 71 — 50,295,945 ARS total Voided Orders: 34 Pending / Refunded: 7 (3 pending, 2 refunded, 2 partially refunded) Unique Customer Emails: 107 (plus 41 separate contact emails)
Unique DNI/CUIT:
70 (Argentine national ID / tax identification) Unique Phone Numbers: 34 (102 phone records) Unique Street Addresses: 47 (with apartment, city, province, ZIP)
Full Shipping Records:
48 (name + address + ZIP) Payment IDs: 88 (Mercado Pago, Binance) Parcel Tracking URLs: 25 (Zippin national courier) Browser IPs: 25 (6 unique, 200.61.172.x range) Order Value Range: 44,990 – 2,603,170 ARS (5 orders over 1,000,000 ARS) Total Order Value: 61,688,408 ARS Payment Methods: Mercado Pago 40 · bank transfer 39 · Binance 22 · cash 9 · crypto 1 Delivery: motomensajería (motorcycle courier) 51 · Zippin 46 Date Rang: 24.05.2025 – 13.08.2026
Compromised Data Includes:
email · contact_email · phone · shipping_name · shipping_address1 · shipping_address2 · shipping_city · shipping_province · shipping_zip · shipping_phone · billing_name · billing_address1 · billing_address2 · billing_city · billing_province · billing_zip · billing_phone · payment_method · numero_identificacion (DNI/CUIT) · condicion_fiscal · payment_id · shipment_type · shipment_tracking_url · order_number · total_price · currency · created_at · browser_ip · customer_id · note_attributes (payment metadata, merchant references, delivery data)
Affected Entities:
CoinCustody (coincustody.io) — Argentine hardware wallet reseller, official Trezor + Ledger product line
212 customers — full order history, emails, home addresses, ID numbers
70 individual DNI/CUIT holders — Argentine identity documents
Crypto holders across Argentina — Buenos Aires, La Plata, Córdoba, Mendoza, Mar del Plata, Quilmes, Tucumán
Corporate accounts — ExxonMobil employee, Establecimiento Las Marías, OpenZeppelin domain users
Foreign buyers — Uruguay, EU (ProtonMail/Proton customers)
Final word
The customers are the highest-value phishing demographic in the world:
People who just bought hardware wallets. They hold crypto. They trust emails about their wallet. They are primed to click "urgent firmware update" links. Name + email + home address + proof of crypto ownership + exact purchase date = a perfect spear-phishing kill list. "Your Ledger Nano X requires a mandatory security update. Confirm your recovery phrase to re-verify." Combined with the DNI numbers and phone numbers, this is also full material for Argentine identity fraud and SIM swapping.
The data spans May 2025 to August 2026. These wallets are still in circulation. These addresses are still current. These phone numbers are still active. Every hardware wallet buyer who ordered from CoinCustody in the last 15 months is in this dump.
107 crypto holders just had their names, home addresses, phone numbers, and ID numbers dumped on the internet. Combined with the live Zippin tracking links, an attacker has everything needed to run an Argentina-wide hardware wallet phishing campaign with exact purchase details. "Tu Ledger necesita una actualización urgente. Confirma tu frase de recuperación aquí.
Pentest Services Available
If you are looking for penetration testing and have targets to attack, we provide such services on the side. We use refined techniques with short turnaround times.
Prices start from $1,500 and up, depending on the target and scope.
DM me for inquiries: t.me/kinglokis
About the leak:
coincustody.io an Argentine online retailer of Trezor and Ledger hardware wallets Full read access to 212 customer orders spanning every purchase from May 2025 through August 13, 2026.
Inside:
107 unique customer email addresses, 70 unique DNI/CUIT numbers (Argentine national ID / tax identification), 47 full street addresses with apartment numbers and postal codes, 34 unique phone numbers, 25 live parcel tracking URLs, 88 payment IDs, and customer browser IPs. Every record ties a real customer — name, email, phone, home address, and ID number to a specific order, payment method, and order value.
The buyers are crypto users. This is a store that sells Trezor Safe 3, Trezor Safe 5, Trezor Model One and Model T, Ledger Nano X, Ledger Nano S Plus, Ledger Stax and Ledger Flex, plus accessories. Every customer in this database has proven they hold — or are about to hold — cryptocurrency on a hardware wallet. That makes this customer list one of the highest-value phishing demographics on the planet: fake firmware updates, fake "security alert" emails, recovery phrase harvesters.
The irony writes itself. Customers bought hardware wallets to protect their crypto — and the store left their names, home addresses, and ID numbers open to anyone who knows how to send an HTTP request.
Most customers are private individuals in Buenos Aires (CABA, Palermo, Almagro, Belgrano, Flores), La Plata, Córdoba, Mendoza, Mar del Plata, Quilmes, Yerba Buena and San Francisco Solano. The base also contains corporate and foreign accounts: an ExxonMobil employee, Argentina's Establecimiento Las Marías (yerba mate producer), a Uruguayan buyer, and EU-based customers (ProtonMail/Proton, OpenZeppelin email domain) — which makes this a GDPR event on top of Argentina's Ley 25.326.
Format:
Full Shopify order database export (CSV, 278 records across 3 order API pulls) Unique Orders: 212 (order numbers 1873 – 2231) Paid Orders: 71 — 50,295,945 ARS total Voided Orders: 34 Pending / Refunded: 7 (3 pending, 2 refunded, 2 partially refunded) Unique Customer Emails: 107 (plus 41 separate contact emails)
Unique DNI/CUIT:
70 (Argentine national ID / tax identification) Unique Phone Numbers: 34 (102 phone records) Unique Street Addresses: 47 (with apartment, city, province, ZIP)
Full Shipping Records:
48 (name + address + ZIP) Payment IDs: 88 (Mercado Pago, Binance) Parcel Tracking URLs: 25 (Zippin national courier) Browser IPs: 25 (6 unique, 200.61.172.x range) Order Value Range: 44,990 – 2,603,170 ARS (5 orders over 1,000,000 ARS) Total Order Value: 61,688,408 ARS Payment Methods: Mercado Pago 40 · bank transfer 39 · Binance 22 · cash 9 · crypto 1 Delivery: motomensajería (motorcycle courier) 51 · Zippin 46 Date Rang: 24.05.2025 – 13.08.2026
Compromised Data Includes:
email · contact_email · phone · shipping_name · shipping_address1 · shipping_address2 · shipping_city · shipping_province · shipping_zip · shipping_phone · billing_name · billing_address1 · billing_address2 · billing_city · billing_province · billing_zip · billing_phone · payment_method · numero_identificacion (DNI/CUIT) · condicion_fiscal · payment_id · shipment_type · shipment_tracking_url · order_number · total_price · currency · created_at · browser_ip · customer_id · note_attributes (payment metadata, merchant references, delivery data)
Affected Entities:
CoinCustody (coincustody.io) — Argentine hardware wallet reseller, official Trezor + Ledger product line
212 customers — full order history, emails, home addresses, ID numbers
70 individual DNI/CUIT holders — Argentine identity documents
Crypto holders across Argentina — Buenos Aires, La Plata, Córdoba, Mendoza, Mar del Plata, Quilmes, Tucumán
Corporate accounts — ExxonMobil employee, Establecimiento Las Marías, OpenZeppelin domain users
Foreign buyers — Uruguay, EU (ProtonMail/Proton customers)
PHP Code:
Sample Data Individual Crypto Wallet Buyers
Code:
NICOLÁS NAHUAL SALAZAR | salazarniko2002@gmail.com | 03813305173 | DNI 20441892358 | Portela, CABA (Flores) 1406 | Mercado Pago 112687591817 | motomensajería | 204,240.50 ARS — order 1877, 28.05.2025 VICTORIA CASAMIQUELA GERHOLD | victoria_gerhold@hotmail.com | 1131794279 | DNI 31794902 | Junín, CABA 1113 | bank transfer | Zippin | 284,981.00 ARS — order 1927, 18.08.2025 YAGO CARVALHO | yagocarvalho.ar@gmail.com | 1140838645 | DNI 96425909 | Beruti, Palermo 1425 | Binance | motomensajería | 390,440.00 ARS — order 1882, 07.06.2025 TOMÁS PRIOTTI | tomipriotti@hotmail.com | 3517617762 | DNI 29761325 | Río Bamba, Córdoba 5003 | Mercado Pago 140013272417 | Zippin | 149,999.00 ARS — order 2029, 04.01.2026 FERMIN RODRIGUEZ | frodriguezpenelas@gmail.com | 541156924049 | DNI 39654009 | Cap. Gral. Ramón Freire 2232 2C, CABA 1428 | Mercado Pago 168824520080 | motomensajería | 180,481.00 ARS — order 2186, 14.07.2026 BENJAMIN GALEANO | galeanobenjamin20@gmail.com | 1157500042 | DNI 43323062 | San Francisco Solano 1881 | Mercado Pago 172808666360 | Zippin | 214,990.00 ARS — order 2213, 08.08.2026
Sample Data Corporate and Foreign Customers
Code:
JUAN CORDOVA | juan.c.cordova@exxonmobil.com | +541131201939 | Ituzaingó 186, Bernal B1876 | 1,196,959.15 ARS — order 2184, 14.07.2026 — ExxonMobil employee ARIEL PEREYRA | apereyra@lasmarias.com.ar | +5491164457958 | Gral. Daniel Cerri 1074, CABA C1168 | 545,317.50 ARS — order 2188, 17.07.2026 — Establecimiento Las Marías FRJ15@proton.me | 398,981.00 ARS — order 2190, 21.07.2026 — ProtonMail customer (EU privacy-oriented) BRIAN TECSPAL UY | 9989007704179 | 860,625.00 ARS — order 2196, 29.07.2026 — Uruguayan buyer GENESIS JIMENEZ | aurinel.jimenez@gmail.com | +541122958883 | Av. General San Martín 4550, Lomas del Mirador B1751 | 137,490.00 ARS — order 2183, 14.07.2026
Sample Data Payment and Delivery Records
Code:
Payment 1 — Mercado Pago | payment_id 168824520080 | DNI 39654009 | Consumidor Final | 180,481.00 ARS — order 2186 Payment 2 — Binance | merchant reference ste3nskk0 | DNI 36907984 | Consumidor Final | 513,940.00 ARS — order 2228 Payment 3 — Binance | merchant reference zk2syynna | DNI 96002170 | Consumidor Final | 513,940.00 ARS — order 2199 (voided) Delivery 1 — Zippin | app.zipnova.com.ar/track/1Ce1B95Fy5VMgMiR9zhhaY | order 2228 Delivery 2 — motomensajería | CABA/GBA motorcycle courier | 51 orders Order values — 5 orders over 1,000,000 ARS, top order 2,603,170 ARS | Mean 290,983 ARS Status mix — 171 paid | 34 voided | 3 pending | 2 refunded | 2 partially refunded
Sample Data — Storefront and Product Line
Code:
Trezor Safe 3 · Trezor Safe 5 · Trezor Model One · Trezor Model T · Trezor Keep Metal Ledger Nano X · Ledger Nano S Plus · Ledger Stax · Ledger Flex · Ledger cases and straps all hardware wallets bought to secure crypto, all buyer identities now exposed
Final word
The customers are the highest-value phishing demographic in the world:
People who just bought hardware wallets. They hold crypto. They trust emails about their wallet. They are primed to click "urgent firmware update" links. Name + email + home address + proof of crypto ownership + exact purchase date = a perfect spear-phishing kill list. "Your Ledger Nano X requires a mandatory security update. Confirm your recovery phrase to re-verify." Combined with the DNI numbers and phone numbers, this is also full material for Argentine identity fraud and SIM swapping.
The data spans May 2025 to August 2026. These wallets are still in circulation. These addresses are still current. These phone numbers are still active. Every hardware wallet buyer who ordered from CoinCustody in the last 15 months is in this dump.
107 crypto holders just had their names, home addresses, phone numbers, and ID numbers dumped on the internet. Combined with the live Zippin tracking links, an attacker has everything needed to run an Argentina-wide hardware wallet phishing campaign with exact purchase details. "Tu Ledger necesita una actualización urgente. Confirma tu frase de recuperación aquí.
Pentest Services Available
If you are looking for penetration testing and have targets to attack, we provide such services on the side. We use refined techniques with short turnaround times.
Prices start from $1,500 and up, depending on the target and scope.
DM me for inquiries: t.me/kinglokis
Ban reason: selling public database Coincustody.io (Permanent)