Coinsbuy Got Hacked for $8M, Refilled the Wallets, and Called It a Day 🪙

Crypto payments platform Coinsbuy lost more than $8 million in an Aug. 9 attack that spanned the Tron and Ethereum networks, with the same perpetrator linked across both chains through the Bridgers cross-chain swap service. Blockchain investigator BlockWatchdog, which detailed the timeline in a post on X, said the operation opened with a 5 USDT test transaction on Tron before more than 6 million USDT was drained from eight Coinsbuy wallets. On Ethereum, an additional 1.89 million USDT and 77 ETH were taken from three wallets.

The attacker moved roughly $6.34 million, or 79% of the stolen funds, through the FixedFloat exchange, with another 150 ETH routed via ChangeNOW, according to BlockWatchdog. About 282.2 ETH, valued at approximately $542,000 at the time, was left sitting across five addresses. SpecterAnalyst reported separately on Telegram that the attacker began funneling assets into Monero through exchanges, and that ChangeNOW assisted in freezing a six-figure portion of the stolen funds. Coinsbuy temporarily suspended deposits and withdrawals before restoring both services.

Hours after the theft, Coinsbuy replenished the affected wallets. BlockWatchdog said around $3.93 million was returned to the same 10 addresses, with seven deposits matching the original amounts to within 0.05%. "That only makes sense if the team does not believe the private keys leaked," BlockWatchdog wrote. "An address is a key: nobody tops up a compromised wallet with seven figures twice in one night. Whatever was taken over on 9 August sat above the keys—the withdrawal path that uses them." The investigator added, "Nothing on-chain shows how the withdrawal path was reached—the refill argues against key theft, it does not name what replaced it," and noted zero address overlap with the July 24 Triple-A attacker along with a different laundering pattern. The exact attack vector remains undisclosed, though BlockWatchdog suggested the attacker may have gained access to Coinsbuy's withdrawal system.

Coinsbuy confirmed the Aug. 9 incident in a statement to Cointelegraph, writing, "All affected client funds have been fully covered by Coinsbuy from our own reserves, so our users have not experienced any financial losses. The platform is back to operating normally, with all services fully available." The company is investigating but said it will not release technical details until the review concludes and findings are verified. Coinsbuy, which is incorporated in Panama and provides businesses with infrastructure to accept, store, send and exchange digital assets, did not confirm or dispute the $7.9 million figure and did not immediately respond to a Decrypt request for comment. The platform also posted a $100,000 reward for information leading to the identification of those responsible, plus an additional bonus tied to recovery of the stolen funds.

The breach lands against a broader backdrop of crypto losses, with DeFi protocols losing more than $840 million to hacks in the first five months of 2026, according to DeFiLlama. July alone saw $24 million taken from Arbitrum-based AFX Trade via an exploited bridge and $18 million lost by decentralized exchange Ostium after an oracle key was compromised. Separately, Ethereum treasury company Bitmine Immersion Technologies said it bought 7,391 ETH over the past week, worth about $14 million, lifting holdings to 5,805,238 ETH as of Friday evening, with $ETH closing the week up 2.6% at $1,928 and total crypto, cash and "moonshot" investments at $11.6 billion.