Coinsbuy Exchange
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
Summary
Coinsbuy is a cryptocurrency processing exchange primarily serving business clients, offering payment processing and wallet services across 25+ digital assets. On August 9, 2026, the platform suffered a coordinated cross-chain attack across Ethereum and TRON that drained approximately $8.07 million in USDT and ETH from eleven hot wallets in under one hour. Coinsbuy stated it absorbed the losses from its own reserves, covering all affected client funds, and offered a $100,000 bounty for identifying the attackers.
Connected Entities
2 entities- TVpX9xCzrj6KHeNhhDJoqjzEqFMxdgubGR→mentioned with→Coinsbuy Exchange(50%)
Connected Through
1 shared actor · 1 investigationDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ◇TVpX9x…ubGRwalletalso inCoinsbuy·26
Timeline(9 events)
9 August 2026
Attack begins at approximately 13:00 UTC. Attacker initiates with a 5 USDT test transaction on TRON, then drains approximately 6.04 million USDT from eight TRON wallets and 1.89 million USDT plus 77 ETH from three Ethereum wallets within roughly one hour.
CoinDesk / BeInCrypto9 August 2026
Approximately $6.34 million (79% of stolen funds) is routed through FixedFloat exchange; 150 ETH transits ChangeNOW. Attacker uses Bridgers cross-chain swap service to link TRON and Ethereum legs.
Decrypt / Crypto Economy9 August 2026
Coinsbuy suspends deposit and withdrawal services. ChangeNOW, with Coinsbuy's cooperation, freezes a six-figure portion of in-flight stolen assets.
KuCoin News Flash9 August 2026
Coinsbuy begins replenishing drained wallets from company reserves; approximately $3.93 million returned to affected addresses within hours, with deposits matching original losses to within 0.05%.
Shattered.io / Crypto Economy10 August 2026
Coinsbuy publishes an official statement on the August 9 Security Incident. The company states all affected client funds have been fully covered from its own reserves and that no client has borne any financial loss.
Coinsbuy official site / PYMNTS10 August 2026
Blockchain investigator BlockWatchdog links the TRON and Ethereum transaction legs via Bridgers. Attacker addresses identified: 0x4d1bEF2Fe998B3E3C4029EF9EA6A0534d95661d3 (ETH hub), 0x66790b54B891e2ebdef58a15B969Ff6fb4374b17 (ETH launderer), TVpX9xCzrj6KHeNhhDJoqjzEqFMxdgubGR (TRON). Blockchain investigator Specter Analyst also cited these addresses in press coverage.
Yahoo Finance / CryptoTimes10 August 2026
Coinsbuy announces a $100,000 bounty for information leading to identification of the perpetrators, plus additional rewards for fund recovery assistance.
CryptoTimes10 August 2026
TechTimes reports the attacker has converted the majority of stolen funds into Monero (XMR), with a recent Monero protocol upgrade further limiting forensic tracing capabilities.
TechTimes10 August 2026
Coinsbuy restores deposit and withdrawal services. As of this date, approximately 282.2 ETH (roughly $542,000) remains untouched across five attacker-linked addresses.
Shattered.io / DecryptDecision Log
- #1publish⛓ pending8/28/2026, 12:24:38 PMhash: 49YjAtfoVBRvr48nTLJKcGL8gAnAH6Fq8yu38QhrqhNv
13 of 15 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/28/2026, 12:24:27 PM
last updated: 8/28/2026, 1:34:29 PM
avoid.net — verified advice for a post-truth world