Remote3.co crypto platform leaks 46,000 developer records

Remote3.co

Detected12 September 2026 · 01:12 UTC

Why it matters

A 46,000-record database from Remote3.co, a crypto/Web3 freelancer platform, is circulating, including developer email addresses. This enables targeted phishing and recruitment scams against Web3 developers and founders. Posted around March 2026, it is aged but still usable for credential stuffing and spear-phishing.

MetadataRECORD

CategoryLeak

Severitylow

Priority score45

Detected12 September 2026 · 01:12 UTC

Related items6

Leak● 72

Filtración de base de datos de usuarios de 1win EcuadorA BreachForums user publishing as 'pheisito' posted a thread titled 'DATABASE 1WIN ECUADOR HACKEADO' on 27 October 2026, offering a customer database belonging to the betting platform's Ecuadorian operation. Although the exact record count is not visible, betting-platform dumps typically contain names, identity documents, phone numbers, emails and payment details of local users. For defenders in Ecuador this is a fresh, potentially large PII exposure that enables account takeover and identity fraud against a broad consumer base.

Leak● 56

Oferta de intercambio de documentos internos de SpaceX en BreachForumsA BreachForums user is soliciting trades for what is described as internal SpaceX documentation, indicating stolen proprietary material from a major US aerospace and defense contractor is circulating in the marketplace. The post gives no date, sample or volume, so the authenticity and scale cannot be confirmed, but even partial internal documents from such a contractor can carry export-control and supply-chain risk. Organizations in the aerospace and defense supply chain should assume related technical and contractual material may be exposed and watch for targeted phishing using it.

Leak● 62

Venta de acceso a 50 millones de líneas de datos francesesA forum seller on the PwnFrm onion board is advertising access to a corpus of roughly 50 million lines of French data, a volume consistent with a major aggregated breach or credential dump rather than a niche leak. The thread is login-walled so the exact source organizations, field structure and price are unverified, but records of this size typically include emails, passwords and personal identifiers. Defenders in France and any organization with French customer data should treat this as a possible exposure of their user base and prepare for credential-stuffing and phishing follow-on activity.

Leak● 44

Venta de base de datos y documentos de identidad de CitiA NulledBB seller advertises a 'full company database', scanned identity documents (ID, driver's license, passport), and consumer information data tied to Citi. If genuine, this bundles identity-document data with account records, enabling account takeover and fraud. Verify the claim and monitor for misuse of customer identities.

Leak● 40

Filtración de base de datos de Ingram Content GroupA pwnfrm listing advertises a database from Ingram Content Group (ingramcontent.com) dated April 2026 affecting roughly 19,000 people. While smaller in scale, it involves a major book-distribution firm and can fuel phishing against partners and staff. Verify exposure and monitor for use of the data.

Leak● 66

Filtración de 20 millones de registros de Baxter InternationalA listing on the pwnfrm forum advertises a Baxter International (baxter.com) database dated August 2026 containing 20 million records. Baxter is a major medical-device and healthcare supplier, so exposure of customer, partner, or internal data raises regulatory and supply-chain risk. Defenders should assess whether their data appears in this leak.