Coinsbuy hit by reported $7.9M Ethereum, TRON drain

Wallets linked to crypto payment processor Coinsbuy were reportedly drained of more than $7.9 million across Ethereum and TRON around 13:00 UTC on Aug. 9, according to blockchain investigator Specter and follow up monitoring from security firms. 

Summary

• Wallets linked to Coinsbuy reportedly lost $7.9 million across Ethereum and TRON during Sunday’s drain.
• PeckShield traced stolen funds through ChangeNOW, FixedFloat and BingX after Specter first flagged the drain.
• ChangeNOW reportedly froze a six figure amount while attackers converted part of proceeds into Monero.
• Coinsbuy temporarily paused deposits and withdrawals after the incident before services reportedly resumed hours later.
• GoPlus said activity resembled compromised hot wallet keys or administrator access, though unconfirmed by Coinsbuy.

The attacker then began routing part of the stolen assets through exchanges and toward Monero, a privacy focused cryptocurrency.

PeckShield said the wallets “likely lost” about $7.9 million and traced part of the proceeds through ChangeNOW, FixedFloat and BingX. CertiK’s security feed independently relayed the same estimated loss and exchange routes. The precise attack vector has not been established publicly.

You might also like: Coldcard attacker holds 1,159 BTC as mixing starts

Coinsbuy drain spread across Ethereum and TRON

Specter identified two Ethereum addresses and one TRON address as theft destinations. The cross network movement suggests the attacker obtained access capable of moving assets on more than one chain, but that does not establish whether private keys, administrator credentials or another part of Coinsbuy’s infrastructure was compromised.

JUST IN: Coinsbuy wallet lose $7.9 million in cross-chain incidentThe event affected assets on TRON and Ethereum according to reports pic.twitter.com/L0eZSH05IN

— crypto.news (@cryptodotnews) August 10, 2026

GoPlus Security said the activity was “consistent with hot wallet private key or administrator privilege theft.” That remains an assessment, not a confirmed root cause. Coinsbuy has not published a technical postmortem in the public documentation reviewed on Aug. 10. Its latest visible release notes are dated July 31.

Coinsbuy describes itself as a business focused crypto payment service offering payment processing, wallet infrastructure and digital asset management. Its official site also advertises crypto payment processing and wallet services for businesses.

Stolen funds moved through exchanges toward Monero

After the drain, the attacker began sending stolen assets through exchange services. Specter said the funds were being converted toward Monero, while PeckShield identified ChangeNOW, FixedFloat and BingX among platforms receiving portions of the proceeds.

Coinsbuy $7.9M drain sends funds through 3 exchanges, source: PeckShield

Specter also said ChangeNOW helped freeze a six figure amount before it could move further. ChangeNOW had not issued a separate public statement confirming the exact frozen sum in sources reviewed for this story, so the amount remains attributed to the investigator.

The laundering route resembles patterns seen in other major crypto thefts. In an earlier recovery case, investigators helped freeze about $1.2 million tied to Bo Shen’s stolen assets after funds passed through services including ChangeNOW. Separately, a January wallet theft involved attackers converting stolen Bitcoin and Litecoin into Monero.

Deposits and withdrawals reportedly resumed

Coinsbuy paused deposits and withdrawals after the incident and later restored them, according to Specter’s update and reports citing the investigator. No separate incident notice confirming the timeline was visible in Coinsbuy’s public release notes at the time of review.

It also remains unclear from public disclosures whether the reported $7.9 million consisted entirely of Coinsbuy owned assets, client funds or a combination of both. No customer loss breakdown or reimbursement plan was visible in the company materials reviewed on Aug. 10.

That distinction matters because service restoration does not establish that the investigation is complete or that the full loss has been recovered. The currently verified public picture remains limited to the reported drain, identified theft addresses, laundering activity and a partial freeze.

The case adds to a busy security year. TRM Labs recorded 207 hacks and about $972 million stolen during the first half of 2026, according to data cited in recent industry loss coverage. Infrastructure and operational failures accounted for most of the value lost during that period.

What happens next

The next material update would be a Coinsbuy incident report identifying the attack vector, affected assets, final loss and any customer exposure. Confirmation from ChangeNOW or the other exchanges could also clarify how much was frozen and whether additional funds remain recoverable.

For now, claims about how the attacker obtained access should remain qualified. Security researchers are continuing to trace the listed Ethereum and TRON addresses, but movement into Monero can make later tracing harder once funds leave transparent blockchains.

Read more: South Korea opposition proposes delaying 22% crypto tax to 2030