Key highlights:
- Coinsbuy saw $7.9 million drained from its platform in an attack
- Some stolen funds were converted to Monero to make tracking harder
- ChangeNOW reportedly froze a six-figure amount of the stolen crypto
Crypto payment platform Coinsbuy suffered an attack that drained over $8 million in digital assets on Ethereum and TRON networks.
Blockchain analysts said the attack happened on August 9. The stolen funds were quickly moved through several crypto exchanges. Some were converted to Monero (XMR) due to its privacy features, which makes fund tracing much harder.
#PeckShieldAlert Specter has reported that wallets associated with @coinsbuycom likely lost ~$7.9M in a drain affecting both #TRON & #Ethereum.
The attacker has since deposited a portion of the stolen funds through #ChangeNOW, #FixedFloat, and #BingX. pic.twitter.com/u5sUpLfyIg
— PeckShieldAlert (@PeckShieldAlert) August 10, 2026
Coinsbuy wallets drained on two networks
The hacker first made a small $5 transaction on the crypto payment platform. Experts said this was a test before the larger theft began. Later on, the attacker drained eight TRON wallets, taking about $6.04 million in one hour.
Ethereum wallets were also attacked at around the same time. Three wallets lost about $1.89 million and 77 ETH. The stolen ETH was then swapped through 1inch using a wallet that had been created on the same day.
In total, researchers projected the losses at around $7.9 million. Some other reports put the total loss above $8 million.
Notably, on-chain records showed that the two attacks were connected through Bridgers, a cross-chain swap service. Its Ethereum payout contract sent funds into the wallet used for the ETH swaps.
That connection helped researchers link what had looked like separate transactions to the same attack.
Stolen funds move through instant exchanges and Monero
The attacker’s immediate goal was to clear their tracks after stealing the funds. The first move they made was to pass the assets through instant crypto exchanges. The platforms used were FixedFloat, ChangeNOW, and BingX.
About 79% of the stolen funds were routed through FixedFloat using around 50 different one-time addresses. Some of the funds were also converted to Monero.
Monero has strong privacy features that make it harder for investigators to follow transactions on its blockchain.
ChangeNOW also reportedly froze a six-figure amount of the stolen funds after being contacted by Specter Investigations.
Meanwhile, not all of the stolen assets disappeared. Around 282 ETH, worth $542,000, has not yet been moved. That could give analysts some time to track the attacker to potentially recover some of the funds.
The attack method is still unknown
As of press time, investigators do not know exactly how the attacker got access to the wallets. GoPlus Security said the activity may be due to a compromise of hot wallet private keys or administrator privileges. But this is not a definite explanation.
Another possibility explored by experts is that credentials of the platform may have been compromised.
In response to the attack, Coinsbuy refilled the affected wallets to within 0.05% of their balances before the attack. Researchers said this means that the company is confident its private keys were not exploited.
The platform also temporarily suspended deposits and withdrawals before restoring services hours later.
The Coinsbuy attack is the latest to join the growing list of attacks this year. Just last week, Coldcard users had over $130 million worth of BTC stolen.
Source:: Coinsbuy Loses Over $8M as Attacker Launders Funds Via Monero