$8 Million Stolen from Coinsbuy in Multi-Blockchain Attack

Overview

• On August 9, a hacker stole $8.07 million from Coinsbuy’s wallets on the Tron and Ethereum networks.
• Approximately $6.34 million of the stolen funds were funneled through the FixedFloat exchange.
• Coinsbuy has since replenished the affected wallets, suggesting the private keys were likely not compromised.

Coinsbuy, a cryptocurrency exchange, experienced a significant security breach on August 9, resulting in the theft of over $8 million across both the Tron and Ethereum blockchains. Blockchain analytics firm BlockWatchdog reported that the hacker executed an initial test transaction of 5 USDT on the Tron network before draining more than 6 million USDT from eight of Coinsbuy's wallets. Additionally, the attacker extracted 1.89 million USDT and 77 ETH from three Ethereum wallets.

Using the cross-chain swap service Bridgers, BlockWatchdog linked the transactions on both blockchains to the same perpetrator. The majority of the stolen assets, approximately $6.34 million, were quickly laundered through FixedFloat, while another 150 ETH was moved via ChangeNOW.

Interestingly, BlockWatchdog noted that 282.2 ETH, worth around $542,000 at the time, remained untouched across five separate addresses. After the incident, Coinsbuy took steps to replenish the drained wallets, returning about $3.93 million to the same ten addresses, with seven deposits closely mirroring the original stolen amounts.

BlockWatchdog speculated that this rapid replenishment implies the team at Coinsbuy does not believe the private keys were compromised, as typically, one would not refill a hacked wallet with significant sums. They remarked, "Nobody tops up a compromised wallet with seven figures twice in one night. Whatever was taken over on August 9 sat above the keys—the withdrawal path that uses them." The exact method of the attack remains unclear, although there are indications that the hacker may have exploited Coinsbuy’s withdrawal system.

BlockWatchdog also observed that there were no similarities in address usage with a previous hacker involved in a July 24 incident, indicating different laundering techniques were employed. As of now, Coinsbuy has not publicly addressed how the breach occurred, and the firm has not responded to requests for further clarification.

This incident adds to a troubling trend in the cryptocurrency sector, which has seen significant hacks in recent months. According to DeFiLlama, decentralized finance protocols lost over $840 million to hacks in the first five months of 2026 alone, with notable breaches including a $24 million theft from AFX Trade and an $18 million loss from the Ostium exchange earlier in July.