Audit log

Every state-changing event for Coinsbuy Exchange — August 2026 Hot Wallet Drain: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-01 17:15:20Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   9iDyjivEHyW7…uCYfQdj5copysha256 → base58

   verifying row…

   canonical bytes (18817 B) ▸

   {"actor":"system:backfill","investigation_id":"6f832839-464e-4a68-aa40-a4a3a3db2594","kind":"publish","page_slug":"coinsbuy-exchange-august-2026-hot-wallet-drain","published_at":"2026-09-01T17:15:19.989Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Coinsbuy Exchange — August 2026 Hot Wallet Drain","sections":[{"content":"At approximately 13:00 UTC on August 9, 2026 (21:00 Beijing time), on-chain investigators detected unusual outflows from hot wallets linked to Coinsbuy, a B2B cryptocurrency payment processor serving merchants and exchanges. Security firm PeckShield and blockchain analyst BlockWatchdog were among the first to publicly characterize the incident. Total losses were estimated at approximately $7.9 million to $8.07 million across the Ethereum and TRON networks. The drain affected eleven wallets — eight on TRON and three on Ethereum — and was completed within approximately one hour of the first non-test transaction.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"Coinsbuy Wallets Drained For Over $7.9 Million on Ethereum and Tron — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/10/coinsbuy-wallets-drained-for-over-7-9-million-on-ethereum-and-tron/"},{"credibility":2,"name":"Coinsbuy hit by reported $7.9M Ethereum, TRON drain — Crypto.news","type":"news_article","url":"https://crypto.news/coinsbuy-hit-by-reported-7-9m-ethereum-tron-drain/"},{"credibility":2,"name":"Coinsbuy Hack Drains $8M as July Losses Hit $247M — Shattered.io","type":"news_article","url":"https://shattered.io/coinsbuy-exchange-hack-2026/"}]},{"content":"The attacker reportedly began with a 5 USDT test transaction on TRON — a reconnaissance technique used to confirm that a compromised key or session is functional before committing to full withdrawals. Following the test, eight TRON wallets were drained of approximately 6.04 million USDC (reported variously as USDC or USDT in different sources), and three Ethereum wallets were emptied of approximately 1.89 million USDT plus 77 ETH, for a combined total exceeding $8 million. On the Ethereum side, stolen assets were swapped via 1inch aggregator into ETH using a wallet the attacker created on the day of the attack, then split across 30 or more vanity addresses in 20–100 ETH increments as a layering technique. Investigators from BlockWatchdog identified that the TRON and Ethereum legs were linked through Bridgers, a cross-chain swap service whose Ethereum payout contract routed funds directly into the attacker's Ethereum swap wallet, confirming both withdrawals were part of a single coordinated operation rather than two independent incidents. The precise attack vector — whether hot wallet private key compromise, stolen API credentials, or administrator privilege escalation — has not been publicly confirmed by Coinsbuy. GoPlus Security assessed the pattern as consistent with hot wallet private key or administrator privilege theft, though that represents analysis rather than a confirmed finding. The decision by Coinsbuy to replenish drained wallets within 24 hours led on-chain analysts at BlockWatchdog to suggest the team did not believe the underlying private keys were compromised, implying the attacker may have accessed the withdrawal system through other means.","heading":"Attack Mechanics and Stolen Amounts","severity":"critical","sources":[{"credibility":2,"name":"Hackers Drain $8 Million From Crypto Exchange Across Two Blockchains — Decrypt","type":"news_article","url":"https://decrypt.co/375213/hackers-drain-8-million-from-crypto-platform-coinsbuy"},{"credibility":2,"name":"Coinsbuy Hit by $8M Crypto Attack Across TRON and Ethereum — CoinTrust","type":"news_article","url":"https://www.cointrust.com/market-news/coinsbuy-hit-by-8m-crypto-attack-across-tron-and-ethereum"},{"credibility":2,"name":"Coinsbuy Hack Drains $8M as July Losses Hit $247M — Shattered.io","type":"news_article","url":"https://shattered.io/coinsbuy-exchange-hack-2026/"},{"credibility":2,"name":"Coinsbuy Wallets Lose $7.9M Across Ethereum And TRON As Funds Move Into XMR — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/coinsbuy-wallets-lose-7-9m-across-ethereum-and-tron-as-funds-move-into-xmr/"}]},{"content":"Following the drain, the attacker moved quickly to obscure and liquidate the stolen funds. Blockchain intelligence from BlockWatchdog indicated that approximately 79% of total proceeds — roughly $6.3 to $6.4 million — passed through FixedFloat, a non-custodial swap service that does not require identity verification, using approximately 50 single-use addresses. ChangeNOW, another instant exchange service, was notified by investigators and froze a six-figure portion of the stolen assets before those funds could be further transferred. Approximately 282 ETH (roughly $542,000 at the time) remained untouched across five addresses as of initial reporting. The ultimate destination for a significant portion of the laundered funds was reported by multiple outlets to be Monero (XMR), a privacy-focused cryptocurrency designed to obscure transaction trails on public blockchains. Routing to Monero effectively terminates conventional on-chain tracing. Reports also mentioned BingX as a platform through which some stolen assets were routed, though the extent of its involvement was not detailed by sources.","heading":"Fund Laundering: FixedFloat, ChangeNOW, and Monero","severity":"high","sources":[{"credibility":2,"name":"Coinsbuy Hack News: Over $7.9M Stolen in Ethereum and TRON Exploit — CoinGabbar","type":"news_article","url":"https://www.coingabbar.com/en/crypto-currency-news/coinsbuy-hack-news-7-9-million-drain-ethereum-tron-monero"},{"credibility":2,"name":"Coinsbuy Hit by $8M Crypto Attack Across TRON and Ethereum — CoinTrust","type":"news_article","url":"https://www.cointrust.com/market-news/coinsbuy-hit-by-8m-crypto-attack-across-tron-and-ethereum"},{"credibility":2,"name":"Coinsbuy Suffers Significant $7.9M Drain Across Ethereum and TRON — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/coinsbuy-suffers-significant-7-9m-drain-across-ethereum-and-tron/"},{"credibility":2,"name":"Hackers Drain $7.9M From Coinsbuy; Monero Upgrade Kills Last Forensic Fallback — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/323701/20260810/hackers-drain-79m-coinsbuy-monero-upgrade-kills-last-forensic-fallback.htm"}]},{"content":"Coinsbuy temporarily suspended deposit and withdrawal services following detection of the incident and subsequently restored them within hours. The company publicly stated that all affected client funds were fully covered from company reserves and that no users experienced financial losses. Coinsbuy offered a bounty of up to $100,000 for information leading to the identification of those responsible, with an additional reward available if stolen funds were recovered (contact: compliance@coinsbuy.com). No formal technical postmortem or incident report had been published as of the dates of available reporting. Coinsbuy did not publicly disclose the specific attack vector, the number of customers affected, or the breakdown between customer funds and company funds. The absence of a formal incident statement is noted across multiple reports. The wallet replenishment within 24 hours was interpreted by analysts as suggesting the company believed the underlying private keys remained uncompromised, though Coinsbuy itself did not confirm this assessment publicly.","heading":"Coinsbuy Response and Disclosure","severity":"medium","sources":[{"credibility":2,"name":"Coinsbuy Faces Reported $7.9 Million Crypto Hack Amid Rising 2026 Attacks — BeInCrypto","type":"news_article","url":"https://beincrypto.com/coinsbuy-hack-crypto-august/"},{"credibility":2,"name":"Coinsbuy Hit by $8M Crypto Attack Across TRON and Ethereum — CoinTrust","type":"news_article","url":"https://www.cointrust.com/market-news/coinsbuy-hit-by-8m-crypto-attack-across-tron-and-ethereum"},{"credibility":2,"name":"Coinsbuy hack: crypto service lost $7.9 million — CoinSpot","type":"news_article","url":"https://coinspot.io/en/analysis/coinsbuy-hack-crypto-service-lost-7-9-million-after-wallet-attack/"}]},{"content":"PeckShield and CertiK both referenced the Coinsbuy incident in August 2026 monthly security digests; CertiK's August 2026 report placed total crypto losses for the month at approximately $215 million, with Coinsbuy's $7.9 million cited as one of the notable individual incidents. BlockWatchdog conducted the most detailed on-chain tracing publicly reported, linking the TRON and Ethereum legs through Bridgers and identifying FixedFloat as the primary laundering rail. The attack was first detected by an investigator identified as SpecterAnalyst via Telegram, whose alert preceded formal security firm reporting. No law enforcement action, regulatory filing, or attribution to a specific threat actor has been publicly reported as of available sources. No court filings or government records concerning this specific incident were identified.","heading":"Security Firm Attribution and Broader Context","severity":"high","sources":[{"credibility":2,"name":"Crypto Losses Hit $215 Million in August 2026, With DeFi Exploits at $144.6M: CertiK — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/31/crypto-losses-hit-215-million-in-august-2026-defi-exploits-certik/"},{"credibility":2,"name":"Coinsbuy Crypto Wallets Hit By Cross-Chain Drain On Ethereum And TRON — CrowdFund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/08/296116-coinsbuy-crypto-wallets-hit-by-cross-chain-drain-on-ethereum-and-tron-losses-near-8-million/"},{"credibility":2,"name":"Coinsbuy Hack Drains $8M as July Losses Hit $247M — Shattered.io","type":"news_article","url":"https://shattered.io/coinsbuy-exchange-hack-2026/"}]},{"content":"Several material facts remain publicly unconfirmed as of available reporting. The specific attack vector (private key compromise, stolen API credentials, insider access, or other means) has not been confirmed by Coinsbuy or any security firm with primary access. The exact amount frozen by ChangeNOW was described only as a 'six-figure sum' across all sources; no figure was independently confirmed by ChangeNOW. The precise fraction of funds converted to Monero versus those still traceable on-chain has not been formally quantified. No attribution of the attack to a specific individual, group, or nation-state actor has been published. Coinsbuy has not released a security audit or vulnerability postmortem. The corporate jurisdiction of Coinsbuy (sources variously indicate Panama and Saint Vincent) could affect any future regulatory or legal response.","heading":"Unresolved Questions and Limitations","severity":"medium","sources":[{"credibility":2,"name":"Coinsbuy hit by reported $7.9M Ethereum, TRON drain — Crypto.news","type":"news_article","url":"https://crypto.news/coinsbuy-hit-by-reported-7-9m-ethereum-tron-drain/"},{"credibility":2,"name":"Coinsbuy Faces Reported $7.9 Million Crypto Hack Amid Rising 2026 Attacks — Yahoo Finance / BeInCrypto","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/coinsbuy-faces-reported-7-9-055403041.html"}]}],"sources_used":[{"credibility":2,"name":"Coinsbuy Wallets Drained For Over $7.9 Million on Ethereum and Tron — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/10/coinsbuy-wallets-drained-for-over-7-9-million-on-ethereum-and-tron/"},{"credibility":2,"name":"Hackers Drain $8 Million From Crypto Exchange Across Two Blockchains — Decrypt","type":"news_article","url":"https://decrypt.co/375213/hackers-drain-8-million-from-crypto-platform-coinsbuy"},{"credibility":2,"name":"Crypto hackers drained $8 million from Coinsbuy using a clever cross-chain trick — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/08/10/crypto-exchange-coinsbuy-loses-usd8-million-in-coordinated-two-blockchain-attack"},{"credibility":2,"name":"Coinsbuy hit by reported $7.9M Ethereum, TRON drain — Crypto.news","type":"news_article","url":"https://crypto.news/coinsbuy-hit-by-reported-7-9m-ethereum-tron-drain/"},{"credibility":2,"name":"Coinsbuy Faces Reported $7.9 Million Crypto Hack Amid Rising 2026 Attacks — BeInCrypto","type":"news_article","url":"https://beincrypto.com/coinsbuy-hack-crypto-august/"},{"credibility":2,"name":"Coinsbuy Hack News: Over $7.9M Stolen in Ethereum and TRON Exploit — CoinGabbar","type":"news_article","url":"https://www.coingabbar.com/en/crypto-currency-news/coinsbuy-hack-news-7-9-million-drain-ethereum-tron-monero"},{"credibility":2,"name":"Coinsbuy Crypto Wallets Hit By Cross-Chain Drain On Ethereum And TRON — CrowdFund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/08/296116-coinsbuy-crypto-wallets-hit-by-cross-chain-drain-on-ethereum-and-tron-losses-near-8-million/"},{"credibility":2,"name":"Coinsbuy Hit by $8M Crypto Attack Across TRON and Ethereum — CoinTrust","type":"news_article","url":"https://www.cointrust.com/market-news/coinsbuy-hit-by-8m-crypto-attack-across-tron-and-ethereum"},{"credibility":2,"name":"Coinsbuy Hack Drains $8M as July Losses Hit $247M — Shattered.io","type":"news_article","url":"https://shattered.io/coinsbuy-exchange-hack-2026/"},{"credibility":2,"name":"Coinsbuy Suffers Significant $7.9M Drain Across Ethereum and TRON — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/coinsbuy-suffers-significant-7-9m-drain-across-ethereum-and-tron/"},{"credibility":2,"name":"Coinsbuy hack: crypto service lost $7.9 million — CoinSpot","type":"news_article","url":"https://coinspot.io/en/analysis/coinsbuy-hack-crypto-service-lost-7-9-million-after-wallet-attack/"},{"credibility":2,"name":"Hackers Drain $7.9M From Coinsbuy; Monero Upgrade Kills Last Forensic Fallback — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/323701/20260810/hackers-drain-79m-coinsbuy-monero-upgrade-kills-last-forensic-fallback.htm"},{"credibility":2,"name":"Coinsbuy Wallets Lose $7.9M Across Ethereum And TRON As Funds Move Into XMR — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/coinsbuy-wallets-lose-7-9m-across-ethereum-and-tron-as-funds-move-into-xmr/"},{"credibility":2,"name":"Crypto Losses Hit $215 Million in August 2026, With DeFi Exploits at $144.6M: CertiK — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/31/crypto-losses-hit-215-million-in-august-2026-defi-exploits-certik/"},{"credibility":2,"name":"Coinsbuy Faces Reported $7.9 Million Crypto Hack — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/coinsbuy-faces-reported-7-9-055403041.html"},{"credibility":2,"name":"TRON (TRX) Wallet Drain at Coinsbuy Hits $7.9M — COINOTAG","type":"news_article","url":"https://en.coinotag.com/tron-trx-coinsbuy-wallet-drain-7-9m"},{"credibility":2,"name":"Coinsbuy Suffers Hack, Over $7.9 Million Stolen — KuCoin Flash News","type":"news_article","url":"https://www.kucoin.com/news/flash/coinsbuy-suffers-hack-over-7-9m-stolen-in-ethereum-and-tron"}],"summary":"On August 9, 2026, wallets associated with Coinsbuy — a B2B crypto payment processor and exchange — were drained of approximately $7.9 million across Ethereum and TRON in a coordinated attack completed within roughly one hour. The attacker linked both chains via cross-chain swapper Bridgers and subsequently laundered the majority of proceeds through FixedFloat and into Monero; ChangeNOW froze a six-figure portion. Coinsbuy stated it covered all client losses from company reserves and offered a $100,000 bounty for information leading to the perpetrators' identification.","timeline":[{"date":"2026-08-09","event":"Attack begins at approximately 13:00 UTC. Attacker sends a 5 USDT test transaction on TRON as reconnaissance.","source":"Decrypt, CoinTrust, Shattered.io","source_url":"https://decrypt.co/375213/hackers-drain-8-million-from-crypto-platform-coinsbuy"},{"date":"2026-08-09","event":"Eight TRON wallets drained of approximately 6.04 million USDC within approximately one hour of the test transaction.","source":"CoinTrust, Shattered.io, CryptoTimes","source_url":"https://www.cointrust.com/market-news/coinsbuy-hit-by-8m-crypto-attack-across-tron-and-ethereum"},{"date":"2026-08-09","event":"Three Ethereum wallets drained of approximately 1.89 million USDT and 77 ETH. Assets swapped via 1inch into ETH and split across 30+ vanity addresses.","source":"CoinTrust, Decrypt, CryptoTimes","source_url":"https://www.cointrust.com/market-news/coinsbuy-hit-by-8m-crypto-attack-across-tron-and-ethereum"},{"date":"2026-08-09","event":"BlockWatchdog and SpecterAnalyst identify cross-chain link between TRON and Ethereum legs via Bridgers swapper.","source":"Decrypt, Shattered.io, Crypto.news","source_url":"https://decrypt.co/375213/hackers-drain-8-million-from-crypto-platform-coinsbuy"},{"date":"2026-08-09","event":"Coinsbuy suspends deposit and withdrawal operations. Investigators notify ChangeNOW, which freezes a six-figure portion of stolen assets.","source":"CoinTrust, CoinGabbar, Crypto Economy","source_url":"https://www.cointrust.com/market-news/coinsbuy-hit-by-8m-crypto-attack-across-tron-and-ethereum"},{"date":"2026-08-09","event":"Approximately 79% of stolen proceeds (roughly $6.3–6.4 million) routed through FixedFloat using approximately 50 single-use addresses. Remaining funds begin moving toward Monero.","source":"Shattered.io, CoinTrust, CoinGabbar","source_url":"https://shattered.io/coinsbuy-exchange-hack-2026/"},{"date":"2026-08-10","event":"Coinsbuy restores deposit and withdrawal operations. Company states all client funds covered from company reserves. $100,000 bounty offered for perpetrator identification.","source":"CoinTrust, BeInCrypto, CoinSpot","source_url":"https://www.cointrust.com/market-news/coinsbuy-hit-by-8m-crypto-attack-across-tron-and-ethereum"},{"date":"2026-08-10","event":"Multiple crypto news outlets publish incident reports. PeckShield and CertiK include Coinsbuy in August 2026 security digests.","source":"CryptoTimes, Crypto.news, Decrypt, CrowdFund Insider","source_url":"https://www.cryptotimes.io/2026/08/31/crypto-losses-hit-215-million-in-august-2026-defi-exploits-certik/"},{"date":"2026-08-31","event":"CertiK August 2026 monthly security report cites Coinsbuy incident ($7.9 million) among notable losses in a month totaling approximately $215 million in crypto theft.","source":"CryptoTimes — CertiK August 2026 digest","source_url":"https://www.cryptotimes.io/2026/08/31/crypto-losses-hit-215-million-in-august-2026-defi-exploits-certik/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 1bd5193a-3787-4b59-adb8-6cb88429035fcopy