Wallets linked to crypto payment processor Coinsbuy were reportedly drained of more than $7.9 million across Ethereum and TRON. The attacker quickly started moving part of the stolen crypto through exchanges and toward privacy-focused cryptocurrency Monero.
Blockchain investigator Specter first flagged the suspicious activity, which began at around 13:00 UTC on Aug. 9. Security firm PeckShield subsequently estimated that Coinsbuy-linked wallets “likely lost” roughly $7.9 million and identified ChangeNOW, FixedFloat and BingX among services receiving portions of the stolen funds.
Coinsbuy has yet to publicly disclose exactly how the attacker gained control of the assets.
Coinsbuy funds drained across Ethereum and TRON
Investigators identified two Ethereum addresses and one TRON address that was used to receive stolen Coinsbuy assets. The ability to drain funds on two separate networks could indicate that the attacker got access to wallet infrastructure or privileged credentials capable of authorizing transactions across multiple blockchains. However, there is currently no confirmation that Coinsbuy's private keys were compromised.
On-chain researchers have also reported that the stolen assets included ETH and USDT before portions were swapped, divided between additional wallets and sent through exchange services. The movement appears designed to make following the funds more difficult.
Specter reported that the attacker subsequently began converting stolen assets toward Monero, or XMR. The privacy cryptocurrency can make tracing considerably harder once funds leave transparent blockchains like Ethereum and TRON.
ChangeNOW reportedly managed to freeze a six-figure portion of the funds before they could move further. The precise amount has not been confirmed by ChangeNOW.
Coinsbuy restores deposits and withdrawals
Coinsbuy reportedly suspended deposits and withdrawals after the drain before later restoring services, according to Specter.
Telegram post by Specter
The company did not include an incident report or technical postmortem in its public release notes. Its most recent listed software release is dated July 31 and includes changes to administrative tools and withdrawal functionality, but does not reference the Aug. 9 security incident.
Several major questions therefore remain unanswered.
Coinsbuy has not disclosed whether the approximately $7.9 million consisted of company assets, customer funds or a combination of the two. It has also not announced a reimbursement plan or explained how the attacker received authorization to move funds across multiple blockchains.
Until Coinsbuy publishes a detailed incident report, the exact cause—and the full impact on customers—remains unclear.
