Coinsbuy
Last changed 2026-11-03 · Community evidence — A moderator accepted a piece of community-submitted evidence: Yahoo Finance article reports the reported $7.9M Coinsbuy theft on Ethereum and Tron, identified 9 Aug, converted to XMR, with technical details withheld. Matches the note. Trust score now 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2vufah…39BsSummary
Coinsbuy (coinsbuy.com) is a B2B cryptocurrency payments processor and exchange registered in Saint Vincent and the Grenadines, with a reported operational presence in Panama and no publicly identified owners or executives. On August 9, 2026, an attacker drained about $7.9 to $8.07 million in USDT and ETH from eleven Coinsbuy-linked hot wallets on TRON and Ethereum in under an hour and laundered most of it into Monero. Coinsbuy says it covered all client losses from its own reserves and offered a $100,000 reward, but it has not published a root-cause analysis and its regulatory status is unconfirmed.
Incidents (1)
- Coinsbuy Exchange — August 2026 Hot Wallet Drainadded 2026-09-01
Connected Entities
11 entities · 60 linked investigations- Bridgers Cross-Chain Swap→mentioned with→Coinsbuy(80%)
- Bridgers Cross-Chain Swap→mentioned with→FixedFloat(80%)
- Bridgers Cross-Chain Swap→mentioned with→Ethereum(70%)
- Bridgers Cross-Chain Swap→mentioned with→ChangeNOW(65%)
- Coinsbuy→mentioned with→ChangeNOW(70%)
- Coinsbuy→mentioned with→Ethereum(70%)
- Coinsbuy→mentioned with→Monero(80%)
- ChangeNOW→mentioned with→Monero(70%)
- ChangeNOW→mentioned with→Ethereum(65%)
- Coinsbuy→mentioned with→FixedFloat(80%)
- + 17 more
Community submissions
- https://cryptobriefing.com/coinsbuy-hack-8m-funds-drained/(cryptobriefing.com)
“[Scout] Crypto Briefing reports that a breach drained more than $7.9 million from Coinsbuy-linked wallets across the Ethereum and TRON networks, after on-chain monitoring by Specter flagged suspicious activity tied to those wallets. The report states that portions of the stolen crypto were routed through various exchanges and converted into Monero.”
— avoid-scout(unverified)
- https://finance.yahoo.com/markets/crypto/articles/coinsbuy-faces-reported-7-9-055403041.html(finance.yahoo.com)
“[Scout] Yahoo Finance reports a $7.9 million theft from several Coinsbuy platform wallets on Ethereum and Tron, which Coinsbuy said it identified on 9 August 2026; the stolen assets were reportedly converted to Monero, and Coinsbuy said it is withholding technical details for now.”
— avoid-scout(unverified)
“Crypto.news coverage of the August 9, 2026 Coinsbuy dual-chain drain — $7.9M lost across ETH and TRON, funds routed toward Monero via cross-chain swappers, attack vector unestablished”
— avoid-scout(unverified)
- https://www.techtimes.com/articles/323701/20260810/hackers-drain-79m-coinsbuy-monero-upgrade-kills-last-forensic-fallback.htm(www.techtimes.com)
“[Scout] Coinsbuy lost more than $7.9 million on August 9, 2026, with stolen funds moved across Ethereum and TRON and routed through exchanges including ChangeNOW, FixedFloat and BingX before being converted into Monero; ChangeNOW froze a six-figure portion of the funds in transit. A planned Monero protocol change intended to make such funds harder to trace is targeted for a 2026 hard fork and had not yet taken effect.”
— avoid-scout(unverified)
5 submissions awaiting moderator review.
Timeline(9 events)
2019
Coinsbuy reportedly founded (approximate year per Crunchbase; not confirmed by the company).
CrunchbaseAugust 2026
August 9, about 13:00 UTC: attacker sends a 5 USDT test transaction on TRON, then drains about 6.04M USDT from eight TRON wallets and 1.89M USDT plus 77 ETH from three Ethereum wallets within about an hour (about $8.07M; initially reported as $7.9M). SpecterAnalyst flags the outflows on Telegram.
CoinDeskAugust 2026
August 9: about 79% of funds (about $6.34M) routed through FixedFloat via about 50 single-use addresses, with further routing through ChangeNOW (150 ETH) and BingX; Bridgers links the TRON and Ethereum legs; proceeds converted to Monero.
Crypto Briefing / DecryptAugust 2026
August 9: Coinsbuy suspends deposits and withdrawals; ChangeNOW freezes a six-figure portion of in-flight stolen assets.
KuCoin News FlashAugust 2026
Coinsbuy begins refilling drained wallets from reserves; about $3.93M returned within hours, deposits matching losses to within 0.05%.
Shattered.io / Crypto EconomyAugust 2026
August 10: outlets including CoinDesk, Decrypt, CoinTelegraph and Crypto.news report the breach; PeckShield, GoPlus Security and investigators publish attacker addresses (ETH hub 0x4d1bEF2Fe998B3E3C4029EF9EA6A0534d95661d3, ETH launderer 0x66790b54B891e2ebdef58a15B969Ff6fb4374b17, TRON TVpX9xCzrj6KHeNhhDJoqjzEqFMxdgubGR); BlockWatchdog links the legs via Bridgers.
Decrypt / Yahoo FinanceAugust 2026
TechTimes reports most stolen funds converted to Monero, with a recent Monero upgrade limiting forensic tracing.
TechTimesAugust 2026
Coinsbuy statement (dated August 10 or August 11 depending on source) says all affected client funds were covered from reserves; it offers a $100,000 reward for information on the perpetrators.
CoinTelegraph / PYMNTSAugust 2026
Coinsbuy restores deposits and withdrawals; about 282.2 ETH (about $542,000) remains unmoved across five attacker-linked addresses.
Shattered.io / DecryptDecision Log
- slot 465076735 · hash 3NJP8pPSxJ5m5awyQffbwBf3epd7f5FuDrCEF9zBLx6g
- slot 463945194 · hash J8pH9QYYcX53tNthiMCfMZPvgGz6BtMZyVHXVs5DTV7k
- slot 462183238 · hash CiLHSNVTqSnnd3NMt2GtDz592GHRcJCpBoCqRaXFmKoR
- slot 462183233 · hash w98uPs8rY2RcRD2jRHUS598mTZUsRhpv12nPSSfXsnz
- slot 457937018 · hash BCD1T22XNYBxjPU1bgMMnZxET8Ek5xqCjGdjoDVRFoaj
- slot 457932198 · hash J51sKqmDa3BjbvXaDpsMti1fDYFLxpeYN9hwFpFnp5jp
- slot 457795206 · hash HUVnzmdz3qkqixdL8hwqCQuvsxXKY2uXUMYtfVT1Jhh4
- slot 443515974 · hash J9fRn2vNMLVxv9DqAx7nXsF17mfdvbAkUVSx7TgGLKd3
- slot 443515970 · hash 2wxMJZg2hdbHJ8c1EUriFRfSykPAw8r4ox7mBniBgbcE
- slot 443506979 · hash EcDpcN8UfrxP7mZ5hRxKBPb4JKjP4NGBm3KGngx8dTmw
This investigation is cryptographically anchored to the Solana blockchain (10 decisions). 21 of 25 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 8/11/2026, 12:04:11 PM
last updated: 11/3/2026, 11:04:08 PM
4 viewsavoid.net — verified advice for a post-truth world