2026 CoinCustody (Argentina) — kingloki order-export claim; 278 records, home addresses + DNI (unverified)
Data compromised
Advertised (unverified): 278 records / 212 orders (May 2025–Aug 2026) with names, emails, DNI/CUIT IDs, home addresses, phones, payment IDs, browser IPs, parcel tracking; Trezor/Ledger device models per order
Technical writeup
Unverified criminal-forum sale claim — August 19, 2026 (Dark Web Informer). Forum user kingloki advertised a complete order export allegedly from coincustody.io, an Argentine reseller of Trezor and Ledger hardware wallets, covering roughly 212 orders placed between May 2025 and August 2026 (278 records across three API pulls per DWI). Advertised fields include customer names, emails, Argentine DNI and CUIT numbers, full street addresses, phone numbers, payment identifiers, browser IPs, and live parcel tracking links tied to specific device purchases. DWI notes the post describes read access to an order interface consistent with an exposed token or misconfigured endpoint rather than a traditional intrusion, and that EU/Uruguay buyers may be in scope. CoinCustody had not publicly addressed the claim at indexing. recordsAffected 278 reflects the actor-cited export volume (unverified). Distinct from ShipMonk/Trezor fulfillment breaches.
Root cause
Unverified forum sale listing — actor kingloki claims read access to coincustody.io order interface / exposed token (Aug 19, 2026); retailer had not confirmed