Coinsbuy Exchange — August 2026 Hot Wallet Drain
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·32UXgB…9VB1Summary
On August 9, 2026, wallets associated with Coinsbuy — a B2B crypto payment processor and exchange — were drained of approximately $7.9 million across Ethereum and TRON in a coordinated attack completed within roughly one hour. The attacker linked both chains via cross-chain swapper Bridgers and subsequently laundered the majority of proceeds through FixedFloat and into Monero; ChangeNOW froze a six-figure portion. Coinsbuy stated it covered all client losses from company reserves and offered a $100,000 bounty for information leading to the perpetrators' identification.
Connected Entities
6 entities · 60 linked investigations- Coinsbuy→mentioned with→ChangeNOW(70%)
- Coinsbuy→mentioned with→Ethereum(70%)
- Coinsbuy→mentioned with→Monero(80%)
- ChangeNOW→mentioned with→Monero(70%)
- ChangeNOW→mentioned with→Ethereum(65%)
- Coinsbuy→mentioned with→FixedFloat(80%)
- ChangeNOW→mentioned with→FixedFloat(70%)
- ChangeNOW→mentioned with→Coinsbuy(70%)
- Coinsbuy Exchange — August 2026 Hot Wallet Drain→mentioned with→Ethereum(70%)
- Coinsbuy Exchange — August 2026 Hot Wallet Drain→mentioned with→Monero(70%)
- + 4 more
1 submission awaiting moderator review.
Timeline(9 events)
9 August 2026
Attack begins at approximately 13:00 UTC. Attacker sends a 5 USDT test transaction on TRON as reconnaissance.
Decrypt, CoinTrust, Shattered.io9 August 2026
Eight TRON wallets drained of approximately 6.04 million USDC within approximately one hour of the test transaction.
CoinTrust, Shattered.io, CryptoTimes9 August 2026
Three Ethereum wallets drained of approximately 1.89 million USDT and 77 ETH. Assets swapped via 1inch into ETH and split across 30+ vanity addresses.
CoinTrust, Decrypt, CryptoTimes9 August 2026
BlockWatchdog and SpecterAnalyst identify cross-chain link between TRON and Ethereum legs via Bridgers swapper.
Decrypt, Shattered.io, Crypto.news9 August 2026
Coinsbuy suspends deposit and withdrawal operations. Investigators notify ChangeNOW, which freezes a six-figure portion of stolen assets.
CoinTrust, CoinGabbar, Crypto Economy9 August 2026
Approximately 79% of stolen proceeds (roughly $6.3–6.4 million) routed through FixedFloat using approximately 50 single-use addresses. Remaining funds begin moving toward Monero.
Shattered.io, CoinTrust, CoinGabbar10 August 2026
Coinsbuy restores deposit and withdrawal operations. Company states all client funds covered from company reserves. $100,000 bounty offered for perpetrator identification.
CoinTrust, BeInCrypto, CoinSpot10 August 2026
Multiple crypto news outlets publish incident reports. PeckShield and CertiK include Coinsbuy in August 2026 security digests.
CryptoTimes, Crypto.news, Decrypt, CrowdFund Insider31 August 2026
CertiK August 2026 monthly security report cites Coinsbuy incident ($7.9 million) among notable losses in a month totaling approximately $215 million in crypto theft.
CryptoTimes — CertiK August 2026 digestDecision Log
- slot 443561446 · hash 7GZ3HueYbcCbrh6LoKLQXzKWppNc3tEVafoqDgBru3hq
- slot 443561444 · hash CphFHuCwnFvJAZgfXkfmVoSL8sPK68rz5PeaU8EtzifB
- slot 443527419 · hash 9iDyjivEHyW7GWcMs3BqkVEZ7Q9NjN1y9JdDuCYfQdj5
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 16 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/1/2026, 5:15:10 PM
last updated: 9/2/2026, 12:37:41 AM
3 viewsavoid.net — verified advice for a post-truth world