$8 Million Stolen From Coinsbuy in Cross-Chain Exploit Affecting Ethereum and Tron Users
Blockchain investigators uncovered a sophisticated attack on crypto platform Coinsbuy that extracted over $8 million across two major blockchains, with clues suggesting the breach targeted the platform's withdrawal infrastructure rather than compromising private keys.
The Attack Unfolds Across Multiple Networks
On August 9, an attacker successfully drained $8.07 million from Coinsbuy wallets distributed across the Ethereum and Tron networks, according to analysis by blockchain investigator BlockWatchdog. The assault began methodically on Tron with a minimal test transaction of 5 USDT before escalating to full-scale extraction. Within minutes, the perpetrator removed more than 6 million USDT from eight separate Coinsbuy wallets on Tron, while simultaneously targeting Ethereum addresses to pilfer an additional 1.89 million USDT and 77 ETH across three wallets.
BlockWatchdog traced the transactions across both chains to the same attacker by identifying cross-chain activity through Bridgers, a swap service facilitating transfers between networks. The investigation revealed that the attacker moved approximately $6.34 million—representing roughly 79 percent of the stolen funds—through FixedFloat, a cryptocurrency exchange platform. An additional 150 ETH transited through ChangeNOW, while a substantial sum of 282.2 ETH, valued near $542,000 at the time of the theft, remained dormant across five addresses.
Clues Point to Withdrawal System Compromise
A telling detail emerged in the aftermath of the breach: Coinsbuy replenished the affected wallets within hours of the theft. The platform returned approximately $3.93 million to the same ten addresses, with seven repayments matching the original stolen amounts to within 0.05 percent precision. BlockWatchdog’s assessment suggested this reimbursement pattern carries significant implications. “That only makes sense if the team does not believe the private keys leaked,” the investigators noted, reasoning that no platform would restore millions to compromised wallets.
This recovery behavior led analysts to conclude the attacker likely gained unauthorized access to Coinsbuy’s withdrawal system itself rather than acquiring the platform’s private cryptographic keys. BlockWatchdog stated the attacker may have exploited the withdrawal infrastructure to execute the transfers, though the precise vector remained unclear at the time of analysis. The platform had not publicly disclosed technical details about the compromise.
Part of a Troubling Trend
The Coinsbuy incident arrives amid an escalating pattern of cryptocurrency platform breaches. According to DeFiLlama data, decentralized finance protocols fell victim to theft exceeding $840 million during the first five months of 2026 alone. Just weeks earlier, on July 24, the Triple-A platform suffered a $24 million attack, while decentralized exchange Ostium lost $18 million following an attacker’s compromise of an oracle key. In the case of Arbitrum-based AFX Trade, hackers exploited a bridge vulnerability to extract $24 million in July.
Notably, BlockWatchdog found zero address overlap between the Coinsbuy attacker and the Triple-A perpetrator, suggesting distinct threat actors employing different operational tactics and laundering methodologies.
Source: BlockWatchdog, via Decrypt. Not financial advice.