Audit log

Every state-changing event for Coinsbuy: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-11 12:04:29Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   EcDpcN8UfrxP…ngx8dTmwcopysha256 → base58

   verifying row…

   canonical bytes (18353 B) ▸

   {"actor":"system:backfill","investigation_id":"640a3b11-d577-4a31-a831-53ed8823ab7a","kind":"publish","page_slug":"coinsbuy","published_at":"2026-08-11T12:04:29.216Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Coinsbuy","sections":[{"content":"Coinsbuy (coinsbuy.com) operates as a B2B cryptocurrency payments processor and exchange, offering wallet infrastructure, payment processing, and digital asset management services to businesses, merchants, and exchanges. The entity 'Coinsbuy Limited' is registered at Suite 305, Griffith Corporate Centre, P.O. Box 1510, Beachmont, Kingstown, Saint Vincent and the Grenadines — a well-known offshore incorporation jurisdiction with limited disclosure requirements. PitchBook records the company's headquarters as Betania, Panama, while Crunchbase lists a founding year of approximately 2019. The platform supports 25+ cryptocurrencies and offers API integration for merchant checkout, AML/KYC screening, two-factor authentication, and crypto-to-fiat conversion in USD and EUR. No founders or named executives have been publicly identified in available sources.","heading":"Company Background and Corporate Structure","severity":"medium","sources":[{"credibility":2,"name":"Coinsbuy 2026 Company Profile — PitchBook","type":"other","url":"https://pitchbook.com/profiles/company/472022-20"},{"credibility":2,"name":"COINSBUY LIMITED Company Profile — Dun & Bradstreet","type":"other","url":"https://www.dnb.com/business-directory/company-profiles.coinsbuy_limited.c0c541672584eeb9335cafeca9aa51e1.html"},{"credibility":2,"name":"Coinsbuy — Crunchbase Company Profile","type":"other","url":"https://www.crunchbase.com/organization/coinsbuy"},{"credibility":3,"name":"Coinsbuy — Cryptwerk listing","type":"other","url":"https://cryptwerk.com/company/coinsbuy/"}]},{"content":"On August 9, 2026, wallets associated with Coinsbuy were drained of approximately $8.07 million across TRON and Ethereum in a coordinated cross-chain attack that unfolded within roughly one hour beginning around 13:00 UTC. The attacker initiated the operation with a test transaction of 5 USDT on TRON before draining eight TRON wallets of approximately 6.04 million USDT. Simultaneously, three Ethereum wallets were emptied of 1.89 million USDT and 77 ETH. Blockchain investigator SpecterAnalyst first flagged the unusual outflows via Telegram; the incident was subsequently corroborated by security firms PeckShield and GoPlus Security. GoPlus assessed the activity as 'consistent with hot wallet private key or administrator privilege theft,' though the precise attack vector was not publicly confirmed. On-chain forensics identified a cross-chain swapper called Bridgers as the mechanism linking the TRON and Ethereum operations into a single coordinated event. The attacker routed approximately 79% of stolen funds through instant exchange FixedFloat using roughly 50 single-use addresses, with additional routing through ChangeNOW and BingX. Proceeds were ultimately converted into Monero (XMR), a privacy coin whose transaction details are shielded from standard blockchain analysis. Coinsbuy temporarily suspended deposits and withdrawals following the incident; services were later restored. The company stated in an August 11, 2026 update: 'All affected client funds have been fully covered by Coinsbuy from our own reserves, so our users have not experienced any financial losses.' The company also offered a $100,000 reward for information identifying the perpetrators, plus additional compensation for recovery assistance. ChangeNOW froze a six-figure sum of the stolen assets; approximately $542,000 in ETH across five addresses had not moved as of the date of reporting. The majority of funds are believed to remain unrecovered.","heading":"August 2026 Security Breach","severity":"critical","sources":[{"credibility":2,"name":"Coinsbuy confirms hack as investigator reports $7.9M stolen — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/coinsbuy-confirms-security-breach-after-wallets-reportedly-drained-of-79m"},{"credibility":2,"name":"Crypto hackers drained $8 million from Coinsbuy using a clever cross-chain trick — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/08/10/crypto-exchange-coinsbuy-loses-usd8-million-in-coordinated-two-blockchain-attack"},{"credibility":2,"name":"Hackers Drain $8 Million From Crypto Exchange Across Two Blockchains — Decrypt","type":"news_article","url":"https://decrypt.co/375213/hackers-drain-8-million-from-crypto-platform-coinsbuy"},{"credibility":2,"name":"Coinsbuy Wallets Drained For Over $7.9 Million on Ethereum and Tron — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/10/coinsbuy-wallets-drained-for-over-7-9-million-on-ethereum-and-tron/"},{"credibility":2,"name":"Coinsbuy hit by reported $7.9M Ethereum, TRON drain — Crypto.news","type":"news_article","url":"https://crypto.news/coinsbuy-hit-by-reported-7-9m-ethereum-tron-drain/"},{"credibility":2,"name":"Coinsbuy offers $100K bounty after reported $7.9M hack — Crypto.news","type":"news_article","url":"https://crypto.news/coinsbuy-offers-100k-bounty-after-reported-7-9m-hack/"},{"credibility":2,"name":"Coinsbuy loses over $8M in funds drained by attacker who laundered proceeds through Monero — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/coinsbuy-hack-8m-funds-drained/"}]},{"content":"Blockchain security firms PeckShield and GoPlus Security publicly identified the primary theft addresses following the August 9, 2026 incident. On Ethereum, the two key addresses were 0x4d1bEF2Fe998B3E3C4029EF9EA6A0534d95661d3 (identified as a hub address) and 0x66790b54B891e2ebdef58a15B969Ff6fb4374b17 (identified as a launderer address). On TRON, the primary theft address was TVpX9xCzrj6KHeNhhDJoqjzEqFMxdgubGR. Analysts noted that simultaneous activity across two separate blockchains pointed to a possible compromise of hot-wallet private keys or elevated administrative privileges rather than a smart-contract exploit. Stolen ETH was reported to have been swapped via 1inch into ETH and then split into 20–100 ETH chunks distributed across 30+ vanity wallets before being routed toward privacy coins. The Bridgers cross-chain swapper was identified as the mechanism linking both chains into a coordinated single operation. The use of FixedFloat with approximately 50 single-use addresses and subsequent conversion to Monero significantly impeded forensic tracing. A 2026 Monero protocol upgrade was separately noted by analysts to further reduce forensic fallback options for investigators.","heading":"On-Chain Forensics and Fund Flow","severity":"high","sources":[{"credibility":2,"name":"Coinsbuy Wallets Drained For Over $7.9 Million on Ethereum and Tron — CryptoTimes","type":"on_chain","url":"https://www.cryptotimes.io/2026/08/10/coinsbuy-wallets-drained-for-over-7-9-million-on-ethereum-and-tron/"},{"credibility":2,"name":"Hackers Drain $7.9M From Coinsbuy; Monero Upgrade Kills Last Forensic Fallback — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/323701/20260810/hackers-drain-79m-coinsbuy-monero-upgrade-kills-last-forensic-fallback.htm"},{"credibility":2,"name":"Coinsbuy-Linked Wallets Hit By $7.9M Crypto Theft, On-Chain Data Shows — BitcoinWorld","type":"on_chain","url":"https://bitcoinworld.co.in/coinsbuy-wallets-hacked-7-9m-crypto-theft/"},{"credibility":2,"name":"Coinsbuy Suffers Hack, Over $7.9 Million Stolen in Ethereum and TRON — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/coinsbuy-suffers-hack-over-7-9m-stolen-in-ethereum-and-tron"}]},{"content":"No SEC, CFTC, FinCEN, or other regulatory enforcement actions against Coinsbuy were identified in publicly available records as of August 2026. The company's incorporation in Saint Vincent and the Grenadines is a well-known offshore structure among crypto firms; this jurisdiction does not impose a formal financial services licensing regime equivalent to those of the EU, UK, or US for crypto exchanges. No FinCEN MSB registration or equivalent money-transmitter licensing information for Coinsbuy has been identified in publicly available sources. The company's dual presence — registered entity in Saint Vincent and operational footprint reportedly in Panama — is a structure associated with regulatory arbitrage in the crypto industry. No KYC/AML enforcement actions were identified. The absence of confirmed regulatory registration represents a risk factor, particularly for institutional or business clients.","heading":"Regulatory and Compliance Status","severity":"high","sources":[{"credibility":2,"name":"COINSBUY LIMITED Company Profile — Dun & Bradstreet","type":"other","url":"https://www.dnb.com/business-directory/company-profiles.coinsbuy_limited.c0c541672584eeb9335cafeca3aa51e1.html"},{"credibility":2,"name":"Coinsbuy 2026 Company Profile — PitchBook","type":"other","url":"https://pitchbook.com/profiles/company/472022-20"}]},{"content":"The August 2026 breach exposed material weaknesses in Coinsbuy's hot wallet management practices. The ability of the attacker to drain funds across eight TRON wallets and three Ethereum wallets in under one hour suggests centralized key management or a compromised administrative credential rather than isolated wallet compromise. GoPlus Security's assessment pointed to hot wallet private key theft or administrator privilege abuse. The company's statement that it refilled drained wallets to within 0.05% of pre-attack balances within 24 hours was noted by analysts as suggesting private keys remained valid post-attack, which some interpreted as indicating the attacker accessed a withdrawal or administrative system rather than the keys themselves — though no definitive root-cause analysis was published. No technical postmortem had been released as of August 11, 2026. The use of multiple instant-exchange services by the attacker (FixedFloat, ChangeNOW, BingX) and conversion to Monero represent a sophisticated laundering chain. The platform's Cryptwerk user rating of 1.4 out of 5 (based on limited reviews) reflects limited public feedback prior to the incident.","heading":"Security Posture and Operational Risk","severity":"high","sources":[{"credibility":2,"name":"Crypto hackers drained $8 million from Coinsbuy using a clever cross-chain trick — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/08/10/crypto-exchange-coinsbuy-loses-usd8-million-in-coordinated-two-blockchain-attack"},{"credibility":2,"name":"Coinsbuy confirms hack as investigator reports $7.9M stolen — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/coinsbuy-confirms-security-breach-after-wallets-reportedly-drained-of-79m"},{"credibility":3,"name":"Coinsbuy — Cryptwerk listing","type":"other","url":"https://cryptwerk.com/company/coinsbuy/"}]},{"content":"The Coinsbuy breach occurred against a backdrop of elevated crypto theft activity in 2026. TRM Labs recorded approximately 207 hacks and $972 million stolen in the first half of 2026. The Coinsbuy incident at approximately $8 million represented a mid-sized breach relative to other 2026 incidents. PYMNTS.com contextualized the hack as part of this broader 2026 theft trend. The overall 2026 H1 figure of $972 million represented a decline from approximately $2.3 billion stolen in the comparable 2025 period, suggesting industry-wide security improvements even as incident frequency increased.","heading":"Industry Context","severity":"low","sources":[{"credibility":2,"name":"Coinsbuy Hack Latest in $972 Million Crypto Theft Spree — PYMNTS.com","type":"news_article","url":"https://www.pymnts.com/cryptocurrency/2026/coinsbuy-hack-latest-in-972-million-crypto-theft-spree/"},{"credibility":2,"name":"Coinsbuy Faces Reported $7.9 Million Crypto Hack Amid Rising 2026 Attacks — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/coinsbuy-faces-reported-7-9-055403041.html"}]}],"sources_used":[{"credibility":2,"name":"Coinsbuy confirms hack as investigator reports $7.9M stolen — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/coinsbuy-confirms-security-breach-after-wallets-reportedly-drained-of-79m"},{"credibility":2,"name":"Crypto hackers drained $8 million from Coinsbuy using a clever cross-chain trick — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/08/10/crypto-exchange-coinsbuy-loses-usd8-million-in-coordinated-two-blockchain-attack"},{"credibility":2,"name":"Hackers Drain $8 Million From Crypto Exchange Across Two Blockchains — Decrypt","type":"news_article","url":"https://decrypt.co/375213/hackers-drain-8-million-from-crypto-platform-coinsbuy"},{"credibility":2,"name":"Coinsbuy Wallets Drained For Over $7.9 Million on Ethereum and Tron — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/10/coinsbuy-wallets-drained-for-over-7-9-million-on-ethereum-and-tron/"},{"credibility":2,"name":"Coinsbuy hit by reported $7.9M Ethereum, TRON drain — Crypto.news","type":"news_article","url":"https://crypto.news/coinsbuy-hit-by-reported-7-9m-ethereum-tron-drain/"},{"credibility":2,"name":"Coinsbuy offers $100K bounty after reported $7.9M hack — Crypto.news","type":"news_article","url":"https://crypto.news/coinsbuy-offers-100k-bounty-after-reported-7-9m-hack/"},{"credibility":2,"name":"Coinsbuy loses over $8M in funds drained by attacker who laundered proceeds through Monero — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/coinsbuy-hack-8m-funds-drained/"},{"credibility":2,"name":"Coinsbuy Hack Latest in $972 Million Crypto Theft Spree — PYMNTS.com","type":"news_article","url":"https://www.pymnts.com/cryptocurrency/2026/coinsbuy-hack-latest-in-972-million-crypto-theft-spree/"},{"credibility":2,"name":"Coinsbuy Suffers Hack, Over $7.9 Million Stolen in Ethereum and TRON — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/coinsbuy-suffers-hack-over-7-9m-stolen-in-ethereum-and-tron"},{"credibility":2,"name":"Coinsbuy Faces Reported $7.9 Million Crypto Hack Amid Rising 2026 Attacks — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/coinsbuy-faces-reported-7-9-055403041.html"},{"credibility":2,"name":"Coinsbuy-Linked Wallets Hit By $7.9M Crypto Theft, On-Chain Data Shows — BitcoinWorld","type":"news_article","url":"https://bitcoinworld.co.in/coinsbuy-wallets-hacked-7-9m-crypto-theft/"},{"credibility":2,"name":"Hackers Drain $7.9M From Coinsbuy; Monero Upgrade Kills Last Forensic Fallback — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/323701/20260810/hackers-drain-79m-coinsbuy-monero-upgrade-kills-last-forensic-fallback.htm"},{"credibility":2,"name":"Coinsbuy Crypto Wallets Hit By Cross-Chain Drain On Ethereum And TRON — Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/08/296116-coinsbuy-crypto-wallets-hit-by-cross-chain-drain-on-ethereum-and-tron-losses-near-8-million/"},{"credibility":2,"name":"Coinsbuy — Crunchbase Company Profile","type":"other","url":"https://www.crunchbase.com/organization/coinsbuy"},{"credibility":2,"name":"Coinsbuy 2026 Company Profile — PitchBook","type":"other","url":"https://pitchbook.com/profiles/company/472022-20"},{"credibility":3,"name":"Coinsbuy — Cryptwerk listing","type":"other","url":"https://cryptwerk.com/company/coinsbuy/"}],"summary":"Coinsbuy (coinsbuy.com) is a B2B cryptocurrency payments platform and exchange incorporated in Saint Vincent and the Grenadines, with reported operational presence in Panama. On August 9, 2026, wallets linked to the platform were drained of approximately $7.9–8.07 million across Ethereum and TRON networks in a coordinated cross-chain attack. The company stated that all affected client funds were covered from its own reserves, though the attack vector remained publicly unconfirmed as of mid-August 2026.","timeline":[{"date":"2019-01-01","event":"Coinsbuy reportedly founded (approximate year; exact date not confirmed in public sources).","source":"Crunchbase","source_url":"https://www.crunchbase.com/organization/coinsbuy"},{"date":"2026-08-09","event":"Wallets linked to Coinsbuy drained of approximately $8.07 million across TRON (6.04M USDT from 8 wallets) and Ethereum (1.89M USDT + 77 ETH from 3 wallets) beginning around 13:00 UTC. Attack initiated with a 5 USDT test transaction. Blockchain investigator SpecterAnalyst first flagged the incident on Telegram.","source":"CoinDesk, CoinTelegraph, Decrypt","source_url":"https://www.coindesk.com/business/2026/08/10/crypto-exchange-coinsbuy-loses-usd8-million-in-coordinated-two-blockchain-attack"},{"date":"2026-08-09","event":"Coinsbuy temporarily suspends deposits and withdrawals following the breach. Attacker routes ~79% of funds through FixedFloat using ~50 single-use addresses; additional routing via ChangeNOW and BingX. Proceeds converted to Monero.","source":"Crypto Briefing, CryptoTimes","source_url":"https://cryptobriefing.com/coinsbuy-hack-8m-funds-drained/"},{"date":"2026-08-09","event":"ChangeNOW freezes a six-figure portion of stolen assets during the laundering process. Approximately $542,000 in ETH remains unmoved across five addresses.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/08/10/crypto-exchange-coinsbuy-loses-usd8-million-in-coordinated-two-blockchain-attack"},{"date":"2026-08-10","event":"Multiple crypto news outlets including CoinDesk, Decrypt, CoinTelegraph, and Crypto.news publish reports on the breach. PeckShield and GoPlus Security publicly share on-chain analysis and suspected theft addresses.","source":"CoinDesk, Decrypt, CoinTelegraph","source_url":"https://decrypt.co/375213/hackers-drain-8-million-from-crypto-platform-coinsbuy"},{"date":"2026-08-11","event":"Coinsbuy issues public statement confirming the breach, stating all affected client funds have been covered from company reserves. Company offers a $100,000 reward for information identifying perpetrators.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/coinsbuy-confirms-security-breach-after-wallets-reportedly-drained-of-79m"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 3427c979-f660-4a9d-bee5-3359a372041acopy