← Coinsbuyreviewed 2026-10-17 · 32 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Coinsbuy against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed 1unverifiable 6link rot 1partially supported 2confirmed 222 corrections pending · 0 applied
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #22[disputed][awaiting moderator]in section: Security Posture and Operational Risk
“The platform's Cryptwerk user rating of 1.4 out of 5 (based on limited reviews) reflects limited public feedback prior to the incident.”
reviewerCoinsbuy's Cryptwerk user rating of 1.4 out of 5 is based on limited reviewsThe 1.4 figure is accurate, but the page's characterization of it as 'based on limited reviews' contradicts the cited source, which shows no reviews at all and does not explain the rating's basis.Proposed correction (not yet applied)The platform's Cryptwerk user rating of 1.4 out of 5 (with no user reviews posted on the page) reflects limited public feedback prior to the incident.
unverifiable
6 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #2[unverifiable][awaiting moderator]in section: Company Background and Corporate Structure
“The entity 'Coinsbuy Limited' is registered at Suite 305, Griffith Corporate Centre, P.O. Box 1510, Beachmont, Kingstown, Saint Vincent and the Grenadines — a well-known offshore incorporation jurisdiction with limited disclosure requirements.”
reviewerCoinsbuy Limited is registered at Suite 305, Griffith Corporate Centre, P.O. Box 1510, Beachmont, Kingstown, Saint Vincent and the GrenadinesThe cited D&B profile blocks automated access, so the specific suite/address could not be independently verified, though a Saint Vincent registration for Coinsbuy is plausible and uncontradicted elsewhere. - #3[unverifiable][awaiting moderator]in section: Company Background and Corporate Structure
“PitchBook records the company's headquarters as Betania, Panama, while Crunchbase lists a founding year of approximately 2019.”
reviewerPitchBook records Coinsbuy's headquarters as Betania, PanamaPitchBook blocks automated access; the HQ claim could not be independently checked against the live page. - #4[unverifiable][awaiting moderator]in section: Company Background and Corporate Structure
“PitchBook records the company's headquarters as Betania, Panama, while Crunchbase lists a founding year of approximately 2019.”
reviewerCrunchbase lists a Coinsbuy founding year of approximately 2019Crunchbase blocks automated access. Same unverified founding-year claim recurs in the timeline (timeline[0]). - #5[unverifiable][awaiting moderator]in section: Company Background and Corporate Structure
“No founders or named executives have been publicly identified in available sources.”
reviewerNo founders or named executives of Coinsbuy have been publicly identifiedA negative/absence claim; my own searching likewise found no named executive, but this cannot be exhaustively confirmed. - #20[unverifiable][awaiting moderator]in section: Regulatory and Compliance Status
“No FinCEN MSB registration or equivalent money-transmitter licensing information for Coinsbuy has been identified in publicly available sources.”
reviewerNo FinCEN MSB registration or equivalent money-transmitter licensing information for Coinsbuy has been identifiedCould not independently query FinCEN's registrant database to confirm the absence; the claim is plausible given Coinsbuy's offshore registration but is unverifiable with the tools available. - #26[unverifiable][awaiting moderator]in the timeline
“Coinsbuy reportedly founded (approximate year; exact date not confirmed in public sources).”
reviewerCoinsbuy reportedly founded in 2019Same unverifiable sourcing issue as the matching claim in sections[0]; the page already hedges this appropriately.
link rot
1 claimA cited source no longer resolves or no longer says what the page attributes to it.
- #32[link rot][awaiting moderator]in the cited sources
“https://web.archive.org/web/20260811121638/https://www.pymnts.com/news/retail/2026/furniture-com-and-flex-pay-turn-77-stores-into-one-purchase/?postType=partial”
reviewerThe PYMNTS source's archived snapshot is a true archival copy of the cited Coinsbuy articleThe stored archive_url for this source does not correspond to the cited live URL at all — it points to a different, unrelated PYMNTS article. The live pymnts.com URL itself still resolves and is topically correct; only the archive_url field is broken/mismatched. No working Wayback snapshot of the correct article was found, so removal rather than replacement is proposed.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #23[partially supported][awaiting moderator]in section: Industry Context
“TRM Labs recorded approximately 207 hacks and $972 million stolen in the first half of 2026.”
reviewerTRM Labs recorded approximately 207 hacks and $972 million stolen in the first half of 2026The underlying statistic is accurate and traceable to TRM Labs via other outlets, but the source cited by the page for this claim does not actually contain the TRM Labs attribution or the 207-hack figure, and uses a different time window ('first seven months' vs 'first half'). - #25[partially supported][awaiting moderator]in section: Industry Context
“The overall 2026 H1 figure of $972 million represented a decline from approximately $2.3 billion stolen in the comparable 2025 period, suggesting industry-wide security improvements even as incident frequency increased.”
reviewerThe $972 million H1 2026 figure represented a decline from approximately $2.3 billion stolen in the comparable 2025 periodFact is independently verifiable and accurate, but not supported by the specific PYMNTS citation given on the page; same underlying citation-mismatch defect as the 207-hacks claim.
confirmed
22 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Company Background and Corporate Structure
“The platform supports 25+ cryptocurrencies and offers API integration for merchant checkout, AML/KYC screening, two-factor authentication, and crypto-to-fiat conversion in USD and EUR.”
reviewerCoinsbuy's platform supports 25+ cryptocurrenciesDirectly corroborated by the live Cryptwerk listing fetched during review. - #6[confirmed][no action needed]in section: August 2026 Security Breach
“On August 9, 2026, wallets associated with Coinsbuy were drained of approximately $8.07 million across TRON and Ethereum in a coordinated cross-chain attack that unfolded within roughly one hour beginning around 13:00 UTC.”
reviewerOn Aug 9, 2026 Coinsbuy wallets were drained of ~$8.07M across TRON (8 wallets, 6.04M USDT) and Ethereum (3 wallets, 1.89M USDT + 77 ETH) within about an hour starting ~13:00 UTCFigures match CoinDesk's reporting exactly. - #7[confirmed][no action needed]in section: August 2026 Security Breach
“The attacker initiated the operation with a test transaction of 5 USDT on TRON before draining eight TRON wallets of approximately 6.04 million USDT.”
reviewerThe attacker opened with a 5 USDT test transaction on TRON before the main drainConfirmed. - #8[confirmed][no action needed]in section: August 2026 Security Breach
“Blockchain investigator SpecterAnalyst first flagged the unusual outflows via Telegram; the incident was subsequently corroborated by security firms PeckShield and GoPlus Security.”
reviewerBlockchain investigator SpecterAnalyst first flagged the outflows on Telegram; PeckShield and GoPlus Security corroboratedA later Decrypt-sourced report uses the handle 'BlockWatchdog' for the on-chain analyst who traced the Bridgers link; this does not contradict SpecterAnalyst being the first to flag outflows, since the page attributes the Bridgers forensics separately (sections[2]) without naming an analyst. - #9[confirmed][no action needed]in section: August 2026 Security Breach
“GoPlus assessed the activity as 'consistent with hot wallet private key or administrator privilege theft,' though the precise attack vector was not publicly confirmed.”
reviewerGoPlus assessed the activity as consistent with hot wallet private key or administrator privilege theftQuote is a close paraphrase of the reported GoPlus assessment, substance matches. - #10[confirmed][no action needed]in section: August 2026 Security Breach
“On-chain forensics identified a cross-chain swapper called Bridgers as the mechanism linking the TRON and Ethereum operations into a single coordinated event.”
reviewerOn-chain forensics identified the cross-chain swapper Bridgers as linking the TRON and Ethereum legs into one coordinated attackConfirmed via Decrypt. - #11[confirmed][no action needed]in section: August 2026 Security Breach
“The attacker routed approximately 79% of stolen funds through instant exchange FixedFloat using roughly 50 single-use addresses, with additional routing through ChangeNOW and BingX.”
reviewerAttacker routed ~79% of stolen funds through FixedFloat via ~50 single-use addresses, plus additional routing through ChangeNOW and BingXConfirmed. - #12[confirmed][no action needed]in section: August 2026 Security Breach
“Proceeds were ultimately converted into Monero (XMR), a privacy coin whose transaction details are shielded from standard blockchain analysis.”
reviewerProceeds were ultimately converted into MoneroConfirmed. - #13[confirmed][no action needed]in section: August 2026 Security Breach
“The company stated in an August 11, 2026 update: 'All affected client funds have been fully covered by Coinsbuy from our own reserves, so our users have not experienced any financial losses.'”
reviewerCoinsbuy's Aug 11, 2026 statement said affected client funds were fully covered from its own reserves with no user lossesQuote verified verbatim. - #14[confirmed][no action needed]in section: August 2026 Security Breach
“The company also offered a $100,000 reward for information identifying the perpetrators, plus additional compensation for recovery assistance.”
reviewerCoinsbuy offered a $100,000 reward for information identifying the perpetrators, plus additional compensation for recovery assistanceConfirmed. - #15[confirmed][no action needed]in section: August 2026 Security Breach
“ChangeNOW froze a six-figure sum of the stolen assets; approximately $542,000 in ETH across five addresses had not moved as of the date of reporting.”
reviewerChangeNOW froze a six-figure sum of stolen assets; ~$542,000 in ETH across 5 addresses had not moved as of reportingConfirmed with exact figures. - #16[confirmed][no action needed]in section: On-Chain Forensics and Fund Flow
“On Ethereum, the two key addresses were 0x4d1bEF2Fe998B3E3C4029EF9EA6A0534d95661d3 (identified as a hub address) and 0x66790b54B891e2ebdef58a15B969Ff6fb4374b17 (identified as a launderer address). On TRON, the primary theft address was TVpX9xCzrj6KHeNhhDJoqjzEqFMxdgubGR.”
reviewerThe Ethereum hub/launderer addresses and the TRON theft address identified by PeckShield/GoPlusConfirmed. - #17[confirmed][no action needed]in section: On-Chain Forensics and Fund Flow
“Stolen ETH was reported to have been swapped via 1inch into ETH and then split into 20–100 ETH chunks distributed across 30+ vanity wallets before being routed toward privacy coins.”
reviewerStolen ETH was swapped via 1inch, split into 20-100 ETH chunks across 30+ vanity walletsConfirmed. - #18[confirmed][no action needed]in section: On-Chain Forensics and Fund Flow
“A 2026 Monero protocol upgrade was separately noted by analysts to further reduce forensic fallback options for investigators.”
reviewerA 2026 Monero protocol upgrade was noted to further reduce forensic fallback options for investigatorsConfirmed. - #19[confirmed][no action needed]in section: Regulatory and Compliance Status
“No SEC, CFTC, FinCEN, or other regulatory enforcement actions against Coinsbuy were identified in publicly available records as of August 2026.”
reviewerNo SEC, CFTC, FinCEN or other regulatory enforcement actions against Coinsbuy were identified in publicly available records as of August 2026A negative/absence claim; my independent search likewise found nothing, which is consistent but not conclusive proof of absence. - #21[confirmed][no action needed]in section: Security Posture and Operational Risk
“The company's statement that it refilled drained wallets to within 0.05% of pre-attack balances within 24 hours was noted by analysts as suggesting private keys remained valid post-attack, which some interpreted as indicating the attacker accessed a withdrawal or administrative system rather than the keys themselves — though no definitive root-cause analysis was published.”
reviewerCoinsbuy's statement that it refilled drained wallets to within 0.05% of pre-attack balances within 24 hours was read by analysts as suggesting keys remained valid and the attacker may have used a withdrawal/admin system rather than stolen keysConfirmed via independent reporting not explicitly listed among this section's own sources, but substantively accurate and not contradicted. - #24[confirmed][no action needed]in section: Industry Context
“PYMNTS.com contextualized the hack as part of this broader 2026 theft trend.”
reviewerPYMNTS.com contextualized the hack as part of the broader 2026 theft trendConfirmed — this part of the claim is accurately sourced to PYMNTS, unlike the TRM Labs attribution in the same section. - #27[confirmed][no action needed]in the timeline
“Wallets linked to Coinsbuy drained of approximately $8.07 million across TRON (6.04M USDT from 8 wallets) and Ethereum (1.89M USDT + 77 ETH from 3 wallets) beginning around 13:00 UTC. Attack initiated with a 5 USDT test transaction. Blockchain investigator SpecterAnalyst first flagged the incident on Telegram.”
reviewerAug 9, 2026 drain: TRON 6.04M USDT from 8 wallets, Ethereum 1.89M USDT + 77 ETH from 3 wallets, 5 USDT test transaction, SpecterAnalyst flagged on TelegramConfirmed, consistent with sections[1]. - #28[confirmed][no action needed]in the timeline
“Coinsbuy temporarily suspends deposits and withdrawals following the breach. Attacker routes ~79% of funds through FixedFloat using ~50 single-use addresses; additional routing via ChangeNOW and BingX. Proceeds converted to Monero.”
reviewerCoinsbuy suspended deposits/withdrawals; attacker routed ~79% via FixedFloat (~50 addresses) plus ChangeNOW/BingX; proceeds to MoneroConfirmed, consistent with sections[1]. - #29[confirmed][no action needed]in the timeline
“ChangeNOW freezes a six-figure portion of stolen assets during the laundering process. Approximately $542,000 in ETH remains unmoved across five addresses.”
reviewerChangeNOW froze a six-figure portion of stolen assets; ~$542,000 in ETH remained unmoved across five addressesConfirmed. - #30[confirmed][no action needed]in the timeline
“Multiple crypto news outlets including CoinDesk, Decrypt, CoinTelegraph, and Crypto.news publish reports on the breach. PeckShield and GoPlus Security publicly share on-chain analysis and suspected theft addresses.”
reviewerAug 10, 2026: multiple outlets publish reports; PeckShield and GoPlus publicly share on-chain analysis and suspected theft addressesConfirmed. - #31[confirmed][no action needed]in the timeline
“Coinsbuy issues public statement confirming the breach, stating all affected client funds have been covered from company reserves. Company offers a $100,000 reward for information identifying perpetrators.”
reviewerAug 11, 2026: Coinsbuy issues public statement confirming breach and fund coverage, offers $100,000 rewardConfirmed.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.