Coinsbuy hack — August 2026

Coinsbuy, a digital asset payment processor serving merchant and enterprise clients, lost about $8.07 million on 9 August 2026 when an attacker emptied eleven of its hot wallets across two chains inside an hour. The operation began with a 5 USDT test transfer on Tron, then took 6.04 million USDT out of eight Tron wallets and 1.89 million USDT plus 77 ETH out of three Ethereum wallets.

Researchers at BlockWatchdog tied the two chains into a single operation through the cross-chain swap service Bridgers. Roughly 79 per cent of the proceeds were routed through the instant exchange FixedFloat across about fifty single-use addresses and converted to Monero; ChangeNOW froze a six-figure sum after Specter Investigations flagged it, and around 282 ETH stayed put across five addresses.

Coinsbuy paused deposits and withdrawals, then refilled the drained wallets from its own reserves within a day, restoring the affected addresses to within 0.05 per cent of their pre-attack balances. It said no client bore a loss and that it could not discuss the technical details while the investigation continued. That the platform could refill the same addresses argues the private keys themselves were not taken, which points to something in the withdrawal path rather than key theft, but no mechanism has been published and none is assumed here.

Reported totals differ slightly by outlet, from $7.9 million to $8.07 million, depending on how the ETH leg was priced. No attribution has been established.