Coinsbuy Exchange — August 2026 Hot Wallet Drain
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
Summary
On August 9, 2026, wallets associated with Coinsbuy — a B2B crypto payment processor and exchange — were drained of approximately $7.9 million across Ethereum and TRON in a coordinated attack completed within roughly one hour. The attacker linked both chains via cross-chain swapper Bridgers and subsequently laundered the majority of proceeds through FixedFloat and into Monero; ChangeNOW froze a six-figure portion. Coinsbuy stated it covered all client losses from company reserves and offered a $100,000 bounty for information leading to the perpetrators' identification.
Connected Entities
1 entitiesTimeline(9 events)
9 August 2026
Attack begins at approximately 13:00 UTC. Attacker sends a 5 USDT test transaction on TRON as reconnaissance.
Decrypt, CoinTrust, Shattered.io9 August 2026
Eight TRON wallets drained of approximately 6.04 million USDC within approximately one hour of the test transaction.
CoinTrust, Shattered.io, CryptoTimes9 August 2026
Three Ethereum wallets drained of approximately 1.89 million USDT and 77 ETH. Assets swapped via 1inch into ETH and split across 30+ vanity addresses.
CoinTrust, Decrypt, CryptoTimes9 August 2026
BlockWatchdog and SpecterAnalyst identify cross-chain link between TRON and Ethereum legs via Bridgers swapper.
Decrypt, Shattered.io, Crypto.news9 August 2026
Coinsbuy suspends deposit and withdrawal operations. Investigators notify ChangeNOW, which freezes a six-figure portion of stolen assets.
CoinTrust, CoinGabbar, Crypto Economy9 August 2026
Approximately 79% of stolen proceeds (roughly $6.3–6.4 million) routed through FixedFloat using approximately 50 single-use addresses. Remaining funds begin moving toward Monero.
Shattered.io, CoinTrust, CoinGabbar10 August 2026
Coinsbuy restores deposit and withdrawal operations. Company states all client funds covered from company reserves. $100,000 bounty offered for perpetrator identification.
CoinTrust, BeInCrypto, CoinSpot10 August 2026
Multiple crypto news outlets publish incident reports. PeckShield and CertiK include Coinsbuy in August 2026 security digests.
CryptoTimes, Crypto.news, Decrypt, CrowdFund Insider31 August 2026
CertiK August 2026 monthly security report cites Coinsbuy incident ($7.9 million) among notable losses in a month totaling approximately $215 million in crypto theft.
CryptoTimes — CertiK August 2026 digestDecision Log
- #1publish⛓ pending9/1/2026, 5:15:20 PMhash: 9iDyjivEHyW7GWcMs3BqkVEZ7Q9NjN1y9JdDuCYfQdj5
12 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/1/2026, 5:15:10 PM
last updated: 9/1/2026, 6:24:11 PM
avoid.net — verified advice for a post-truth world