Audit log

Every state-changing event for Coinsbuy Exchange: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-28 12:24:38Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   49YjAtfoVBRv…8QhrqhNvcopysha256 → base58

   verifying row…

   canonical bytes (22296 B) ▸

   {"actor":"system:backfill","investigation_id":"4b08a223-d7e9-4dd7-afe7-0e5b2f277d20","kind":"publish","page_slug":"coinsbuy-exchange","published_at":"2026-08-28T12:24:38.006Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Coinsbuy Exchange","sections":[{"content":"Coinsbuy is a cryptocurrency exchange and processing platform that describes itself as primarily serving business users including enterprises, merchants, and other exchanges. The platform supports 25+ digital assets with a stated emphasis on USDT across nine blockchain networks. Its services include cryptocurrency payment processing, Wallet-as-a-Service functionality, API integration with AML and KYC screening, and a sandbox testing environment. Coinsbuy's corporate registration has been linked to Saint Vincent and the Grenadines, a jurisdiction that introduced a Virtual Asset Business Act in 2022 administered by its Financial Services Authority. Coinsbuy's specific regulatory status under that framework has not been independently confirmed in the sources reviewed for this page. The company does not publicly disclose its founding year, leadership team, or ownership structure.","heading":"Company Background","severity":"medium","sources":[{"credibility":2,"name":"Coinsbuy official website","type":"official","url":"https://coinsbuy.com/"},{"credibility":2,"name":"Coinsbuy — Crunchbase Company Profile","type":"other","url":"https://www.crunchbase.com/organization/coinsbuy"},{"credibility":2,"name":"KuCoin Flash: Coinsbuy Suffers Hack, Over $7.9 Million Stolen in Ethereum and TRON","type":"news_article","url":"https://www.kucoin.com/news/flash/coinsbuy-suffers-hack-over-7-9m-stolen-in-ethereum-and-tron"}]},{"content":"On August 9, 2026, at approximately 13:00 UTC, an attacker drained an estimated $8.07 million from Coinsbuy hot wallets across the Ethereum and TRON networks in under one hour. The attacker is reported to have initiated the operation with a 5 USDT test transaction on TRON before escalating to large-scale withdrawals. On TRON, approximately 6.04 million USDT was taken from eight wallets. On Ethereum, approximately 1.89 million USDT and 77 ETH were taken from three wallets, for a combined total across both chains of approximately $8.07 million at prevailing prices. Blockchain investigator BlockWatchdog linked the Tron and Ethereum transactions into a single operation through the cross-chain swap service Bridgers. The coordinated timing and multi-chain execution were noted by multiple analysts as indicators of a sophisticated, pre-planned attack. Coinsbuy publicly acknowledged the incident in an official statement published on August 10, 2026, describing it as unauthorized withdrawals from several platform wallets.","heading":"August 9, 2026 Security Incident — Attack Overview","severity":"critical","sources":[{"credibility":2,"name":"Decrypt: Hackers Drain $8 Million From Crypto Exchange Across Two Blockchains","type":"news_article","url":"https://decrypt.co/375213/hackers-drain-8-million-from-crypto-platform-coinsbuy"},{"credibility":1,"name":"CoinDesk: Crypto Exchange Coinsbuy Loses $8 Million in Coordinated Two-Blockchain Attack","type":"news_article","url":"https://www.coindesk.com/business/2026/08/10/crypto-exchange-coinsbuy-loses-usd8-million-in-coordinated-two-blockchain-attack"},{"credibility":2,"name":"BeInCrypto: Coinsbuy Faces Reported $7.9 Million Crypto Hack Amid Rising 2026 Attacks","type":"news_article","url":"https://beincrypto.com/coinsbuy-hack-crypto-august/"},{"credibility":2,"name":"Yahoo Finance: Coinsbuy Faces Reported $7.9 Million Crypto Hack Amid Rising 2026 Attacks","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/coinsbuy-faces-reported-7-9-055403041.html"},{"credibility":2,"name":"Crypto Economy: $8M Crypto Exchange Heist Spans Ethereum and Tron","type":"news_article","url":"https://crypto-economy.com/8m-crypto-exchange-heist-spans-ethereum-and-tron-as-hackers-move-stolen-funds/"}]},{"content":"The precise vulnerability exploited in the August 9 incident had not been publicly confirmed by Coinsbuy as of the time of this investigation. On-chain analysts offered two competing hypotheses. BlockWatchdog speculated, according to reporting by Decrypt and Shattered.io, that the attacker may have gained access to Coinsbuy's withdrawal system rather than compromising underlying private keys directly — a hypothesis supported by the observation that Coinsbuy was able to replenish the drained wallets from reserves within hours, suggesting the keys themselves remained under company control. CryptoTimes reported an alternative hypothesis that the breach reflected possible compromise of hot-wallet private keys or elevated administrative privileges. Neither hypothesis has been confirmed by an official Coinsbuy post-mortem or an independent security audit disclosed publicly. The attack used Bridgers, a cross-chain swap service, to link and obscure the TRON and Ethereum legs of the operation. Approximately 79% of the stolen funds, or about $6.34 million, was subsequently routed through FixedFloat cryptocurrency exchange. An additional 150 ETH was sent through ChangeNOW. The attacker also reportedly used 1inch to rapidly convert stolen assets, splitting funds into 20–100 ETH tranches across more than 30 vanity wallets, before converting proceeds into Monero (XMR) to exploit that coin's privacy features and break the on-chain audit trail.","heading":"Attack Vector and Technical Analysis","severity":"critical","sources":[{"credibility":2,"name":"Decrypt: Hackers Drain $8 Million From Crypto Exchange Across Two Blockchains","type":"news_article","url":"https://decrypt.co/375213/hackers-drain-8-million-from-crypto-platform-coinsbuy"},{"credibility":3,"name":"Shattered.io: Coinsbuy Hack Drains $8M as July Losses Hit $247M","type":"news_article","url":"https://shattered.io/coinsbuy-exchange-hack-2026/"},{"credibility":2,"name":"CryptoTimes: Coinsbuy Wallets Drained For Over $7.9 Million on Ethereum and Tron","type":"news_article","url":"https://www.cryptotimes.io/2026/08/10/coinsbuy-wallets-drained-for-over-7-9-million-on-ethereum-and-tron/"},{"credibility":2,"name":"TechTimes: Hackers Drain $7.9M From Coinsbuy; Monero Upgrade Kills Last Forensic Fallback","type":"news_article","url":"https://www.techtimes.com/articles/323701/20260810/hackers-drain-79m-coinsbuy-monero-upgrade-kills-last-forensic-fallback.htm"}]},{"content":"Blockchain investigator Specter Analyst publicly identified three attacker-controlled addresses associated with the August 9, 2026 incident, as reported by Yahoo Finance and CryptoTimes. On Ethereum, the primary hub address was 0x4d1bEF2Fe998B3E3C4029EF9EA6A0534d95661d3, and a secondary laundering address was 0x66790b54B891e2ebdef58a15B969Ff6fb4374b17. On TRON, the identified address was TVpX9xCzrj6KHeNhhDJoqjzEqFMxdgubGR. As of reporting, approximately 282.2 ETH (valued at roughly $542,000 at the time of the attack) remained untouched across five additional attacker addresses. The identity of the attacker or attackers had not been established as of the sources reviewed. These addresses are attributed to the attacker based on blockchain investigator analysis and have not been confirmed by law enforcement or a court filing.","heading":"Identified Attacker Addresses","severity":"high","sources":[{"credibility":2,"name":"Yahoo Finance: Coinsbuy Faces Reported $7.9 Million Crypto Hack Amid Rising 2026 Attacks","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/coinsbuy-faces-reported-7-9-055403041.html"},{"credibility":2,"name":"CryptoTimes: Coinsbuy Wallets Drained For Over $7.9 Million on Ethereum and Tron","type":"news_article","url":"https://www.cryptotimes.io/2026/08/10/coinsbuy-wallets-drained-for-over-7-9-million-on-ethereum-and-tron/"},{"credibility":2,"name":"Crypto Economy: $8M Crypto Exchange Heist Spans Ethereum and Tron","type":"news_article","url":"https://crypto-economy.com/8m-crypto-exchange-heist-spans-ethereum-and-tron-as-hackers-move-stolen-funds/"}]},{"content":"Coinsbuy temporarily suspended deposit and withdrawal services following the incident; services were subsequently restored. The company published an official statement on August 10, 2026 stating: 'All affected client funds have been fully covered by Coinsbuy from our own reserves, so our users have not experienced any financial losses.' A separate statement confirmed: 'No client has borne any loss.' On-chain data corroborated the company's claim: Coinsbuy replenished the ten drained addresses from its own reserves within approximately 12 to 24 hours, with seven of the replenishment deposits matching the original losses to within 0.05%, according to Shattered.io and Crypto Economy. Coinsbuy also announced a $100,000 bounty for information leading to the identification of the perpetrators, with additional compensation offered for assistance in recovering stolen funds. With the support of ChangeNOW, Coinsbuy reported that a six-figure portion of the stolen assets was frozen before the attacker could complete conversion to Monero. The exact amount frozen was described as a 'six-figure sum' but was not precisely specified in the sources reviewed. No formal post-mortem security audit or disclosure of the root-cause vulnerability has been published by Coinsbuy as of the sources available for this investigation.","heading":"Coinsbuy Response and User Compensation","severity":"medium","sources":[{"credibility":2,"name":"PYMNTS: Coinsbuy Hack Latest in $972 Million Crypto Theft Spree","type":"news_article","url":"https://www.pymnts.com/cryptocurrency/2026/coinsbuy-hack-latest-in-972-million-crypto-theft-spree/"},{"credibility":2,"name":"KuCoin Flash: Coinsbuy Suffers Hack, Over $7.9 Million Stolen in Ethereum and TRON","type":"news_article","url":"https://www.kucoin.com/news/flash/coinsbuy-suffers-hack-over-7-9m-stolen-in-ethereum-and-tron"},{"credibility":3,"name":"Shattered.io: Coinsbuy Hack Drains $8M as July Losses Hit $247M","type":"news_article","url":"https://shattered.io/coinsbuy-exchange-hack-2026/"},{"credibility":2,"name":"Crypto Economy: $8M Crypto Exchange Heist Spans Ethereum and Tron","type":"news_article","url":"https://crypto-economy.com/8m-crypto-exchange-heist-spans-ethereum-and-tron-as-hackers-move-stolen-funds/"},{"credibility":2,"name":"CoinTrust: Coinsbuy Hit by $8M Crypto Attack Across TRON and Ethereum","type":"news_article","url":"https://www.cointrust.com/market-news/coinsbuy-hit-by-8m-crypto-attack-across-tron-and-ethereum"}]},{"content":"The attacker's conversion of the majority of stolen proceeds into Monero (XMR) significantly limited investigators' ability to trace the funds on-chain. Monero uses ring signatures, stealth addresses, and RingCT to obscure sender, receiver, and transaction amounts; TechTimes reported that a recent Monero protocol upgrade further degraded the forensic fallback methods previously available to investigators. Approximately $6.34 million was routed through FixedFloat, and 150 ETH through ChangeNOW, prior to the Monero conversion step. The use of Bridgers as a cross-chain swap to link and obfuscate the Ethereum and TRON legs of the attack, combined with the 30-plus vanity wallet splitting strategy documented by CryptoTimes, reflects a methodical laundering operation. ChangeNOW cooperated with Coinsbuy's incident response and froze a six-figure portion of the in-flight assets. FixedFloat's cooperation status has not been reported in the sources reviewed. No law enforcement agency has been named as actively investigating the incident in the sources available.","heading":"Fund Laundering and Forensic Challenges","severity":"high","sources":[{"credibility":2,"name":"TechTimes: Hackers Drain $7.9M From Coinsbuy; Monero Upgrade Kills Last Forensic Fallback","type":"news_article","url":"https://www.techtimes.com/articles/323701/20260810/hackers-drain-79m-coinsbuy-monero-upgrade-kills-last-forensic-fallback.htm"},{"credibility":3,"name":"MyCryptoParadise: Coinsbuy Hack Drains $7.9M, Funds Vanish Into Monero","type":"news_article","url":"https://mycryptoparadise.com/coinsbuy-hack-drains-7-9m-funds-vanish-into-monero/"},{"credibility":2,"name":"CryptoTimes: Coinsbuy Wallets Drained For Over $7.9 Million on Ethereum and Tron","type":"news_article","url":"https://www.cryptotimes.io/2026/08/10/coinsbuy-wallets-drained-for-over-7-9-million-on-ethereum-and-tron/"}]},{"content":"The Coinsbuy incident was the largest reported crypto exchange breach in August 2026 at the time of coverage. According to PYMNTS, approximately $972 million was stolen across the crypto sector in the first seven months of 2026, spanning 207 incidents — more than double the 83 incidents recorded in H1 2025, though total dollar losses were lower than the approximately $2.3 billion recorded across all of 2025. Other notable 2026 incidents cited in coverage include the Wemix Network stablecoin compromise, a $2.4 million theft from wallet service SecondFi that prompted the company to wind down, and a reported $100 million loss from a Coldcard hardware wallet firmware vulnerability affecting wallet recovery phrases.","heading":"Broader 2026 Crypto Security Context","severity":"medium","sources":[{"credibility":2,"name":"PYMNTS: Coinsbuy Hack Latest in $972 Million Crypto Theft Spree","type":"news_article","url":"https://www.pymnts.com/cryptocurrency/2026/coinsbuy-hack-latest-in-972-million-crypto-theft-spree/"},{"credibility":2,"name":"Yahoo Finance: Hackers Drain $8 Million From Crypto Exchange Across Two Blockchains","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/hackers-drain-8-million-crypto-155630618.html"}]},{"content":"Several material disclosures remain absent from Coinsbuy's public communications as of the sources reviewed for this page. The company has not published a technical post-mortem identifying the root-cause vulnerability, the security measures that failed, or remediation steps taken. No independent third-party security audit of the incident has been publicly announced. Coinsbuy's ownership structure, executive team, and full regulatory registration details are not disclosed on the company website or in the sources reviewed. The company's claim that all client funds were made whole is consistent with on-chain data reviewed by multiple analysts, but has not been independently verified through a third-party audit. The absence of a published root-cause analysis leaves the nature of the vulnerability unconfirmed and precludes external assessment of whether the underlying weakness has been resolved.","heading":"Transparency and Disclosure Gaps","severity":"high","sources":[{"credibility":2,"name":"Coinsbuy official website","type":"official","url":"https://coinsbuy.com/"},{"credibility":2,"name":"Decrypt: Hackers Drain $8 Million From Crypto Exchange Across Two Blockchains","type":"news_article","url":"https://decrypt.co/375213/hackers-drain-8-million-from-crypto-platform-coinsbuy"}]}],"sources_used":[{"credibility":1,"name":"CoinDesk: Crypto Exchange Coinsbuy Loses $8 Million in Coordinated Two-Blockchain Attack","type":"news_article","url":"https://www.coindesk.com/business/2026/08/10/crypto-exchange-coinsbuy-loses-usd8-million-in-coordinated-two-blockchain-attack"},{"credibility":2,"name":"Decrypt: Hackers Drain $8 Million From Crypto Exchange Across Two Blockchains","type":"news_article","url":"https://decrypt.co/375213/hackers-drain-8-million-from-crypto-platform-coinsbuy"},{"credibility":2,"name":"BeInCrypto: Coinsbuy Faces Reported $7.9 Million Crypto Hack Amid Rising 2026 Attacks","type":"news_article","url":"https://beincrypto.com/coinsbuy-hack-crypto-august/"},{"credibility":2,"name":"Yahoo Finance: Coinsbuy Faces Reported $7.9 Million Crypto Hack Amid Rising 2026 Attacks","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/coinsbuy-faces-reported-7-9-055403041.html"},{"credibility":2,"name":"Yahoo Finance: Hackers Drain $8 Million From Crypto Exchange Across Two Blockchains","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/hackers-drain-8-million-crypto-155630618.html"},{"credibility":2,"name":"PYMNTS: Coinsbuy Hack Latest in $972 Million Crypto Theft Spree","type":"news_article","url":"https://www.pymnts.com/cryptocurrency/2026/coinsbuy-hack-latest-in-972-million-crypto-theft-spree/"},{"credibility":2,"name":"KuCoin Flash: Coinsbuy Suffers Hack, Over $7.9 Million Stolen in Ethereum and TRON","type":"news_article","url":"https://www.kucoin.com/news/flash/coinsbuy-suffers-hack-over-7-9m-stolen-in-ethereum-and-tron"},{"credibility":2,"name":"CryptoTimes: Coinsbuy Wallets Drained For Over $7.9 Million on Ethereum and Tron","type":"news_article","url":"https://www.cryptotimes.io/2026/08/10/coinsbuy-wallets-drained-for-over-7-9-million-on-ethereum-and-tron/"},{"credibility":2,"name":"Crypto Economy: $8M Crypto Exchange Heist Spans Ethereum and Tron as Hackers Move Stolen Funds","type":"news_article","url":"https://crypto-economy.com/8m-crypto-exchange-heist-spans-ethereum-and-tron-as-hackers-move-stolen-funds/"},{"credibility":2,"name":"CoinTrust: Coinsbuy Hit by $8M Crypto Attack Across TRON and Ethereum","type":"news_article","url":"https://www.cointrust.com/market-news/coinsbuy-hit-by-8m-crypto-attack-across-tron-and-ethereum"},{"credibility":2,"name":"TechTimes: Hackers Drain $7.9M From Coinsbuy; Monero Upgrade Kills Last Forensic Fallback","type":"news_article","url":"https://www.techtimes.com/articles/323701/20260810/hackers-drain-79m-coinsbuy-monero-upgrade-kills-last-forensic-fallback.htm"},{"credibility":3,"name":"MyCryptoParadise: Coinsbuy Hack Drains $7.9M, Funds Vanish Into Monero","type":"news_article","url":"https://mycryptoparadise.com/coinsbuy-hack-drains-7-9m-funds-vanish-into-monero/"},{"credibility":3,"name":"Shattered.io: Coinsbuy Hack Drains $8M as July Losses Hit $247M","type":"news_article","url":"https://shattered.io/coinsbuy-exchange-hack-2026/"},{"credibility":2,"name":"Coinsbuy official website","type":"official","url":"https://coinsbuy.com/"},{"credibility":2,"name":"Coinsbuy — Crunchbase Company Profile","type":"other","url":"https://www.crunchbase.com/organization/coinsbuy"}],"summary":"Coinsbuy is a cryptocurrency processing exchange primarily serving business clients, offering payment processing and wallet services across 25+ digital assets. On August 9, 2026, the platform suffered a coordinated cross-chain attack across Ethereum and TRON that drained approximately $8.07 million in USDT and ETH from eleven hot wallets in under one hour. Coinsbuy stated it absorbed the losses from its own reserves, covering all affected client funds, and offered a $100,000 bounty for identifying the attackers.","timeline":[{"date":"2026-08-09","event":"Attack begins at approximately 13:00 UTC. Attacker initiates with a 5 USDT test transaction on TRON, then drains approximately 6.04 million USDT from eight TRON wallets and 1.89 million USDT plus 77 ETH from three Ethereum wallets within roughly one hour.","source":"CoinDesk / BeInCrypto","source_url":"https://www.coindesk.com/business/2026/08/10/crypto-exchange-coinsbuy-loses-usd8-million-in-coordinated-two-blockchain-attack"},{"date":"2026-08-09","event":"Approximately $6.34 million (79% of stolen funds) is routed through FixedFloat exchange; 150 ETH transits ChangeNOW. Attacker uses Bridgers cross-chain swap service to link TRON and Ethereum legs.","source":"Decrypt / Crypto Economy","source_url":"https://decrypt.co/375213/hackers-drain-8-million-from-crypto-platform-coinsbuy"},{"date":"2026-08-09","event":"Coinsbuy suspends deposit and withdrawal services. ChangeNOW, with Coinsbuy's cooperation, freezes a six-figure portion of in-flight stolen assets.","source":"KuCoin News Flash","source_url":"https://www.kucoin.com/news/flash/coinsbuy-suffers-hack-over-7-9m-stolen-in-ethereum-and-tron"},{"date":"2026-08-09","event":"Coinsbuy begins replenishing drained wallets from company reserves; approximately $3.93 million returned to affected addresses within hours, with deposits matching original losses to within 0.05%.","source":"Shattered.io / Crypto Economy","source_url":"https://shattered.io/coinsbuy-exchange-hack-2026/"},{"date":"2026-08-10","event":"Coinsbuy publishes an official statement on the August 9 Security Incident. The company states all affected client funds have been fully covered from its own reserves and that no client has borne any financial loss.","source":"Coinsbuy official site / PYMNTS","source_url":"https://www.pymnts.com/cryptocurrency/2026/coinsbuy-hack-latest-in-972-million-crypto-theft-spree/"},{"date":"2026-08-10","event":"Blockchain investigator BlockWatchdog links the TRON and Ethereum transaction legs via Bridgers. Attacker addresses identified: 0x4d1bEF2Fe998B3E3C4029EF9EA6A0534d95661d3 (ETH hub), 0x66790b54B891e2ebdef58a15B969Ff6fb4374b17 (ETH launderer), TVpX9xCzrj6KHeNhhDJoqjzEqFMxdgubGR (TRON). Blockchain investigator Specter Analyst also cited these addresses in press coverage.","source":"Yahoo Finance / CryptoTimes","source_url":"https://finance.yahoo.com/markets/crypto/articles/coinsbuy-faces-reported-7-9-055403041.html"},{"date":"2026-08-10","event":"Coinsbuy announces a $100,000 bounty for information leading to identification of the perpetrators, plus additional rewards for fund recovery assistance.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/10/coinsbuy-wallets-drained-for-over-7-9-million-on-ethereum-and-tron/"},{"date":"2026-08-10","event":"TechTimes reports the attacker has converted the majority of stolen funds into Monero (XMR), with a recent Monero protocol upgrade further limiting forensic tracing capabilities.","source":"TechTimes","source_url":"https://www.techtimes.com/articles/323701/20260810/hackers-drain-79m-coinsbuy-monero-upgrade-kills-last-forensic-fallback.htm"},{"date":"2026-08-10","event":"Coinsbuy restores deposit and withdrawal services. As of this date, approximately 282.2 ETH (roughly $542,000) remains untouched across five attacker-linked addresses.","source":"Shattered.io / Decrypt","source_url":"https://shattered.io/coinsbuy-exchange-hack-2026/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision bdb67d5d-d594-4620-9b64-925224c06fc7copy