Coinsbuy hit by reported $7.9M Ethereum, TRON drain

Wallets linked to crypto payment processor Coinsbuy were reportedly drained of more than $7.9 million across Ethereum and TRON around 13:00 UTC on Aug. 9, according to blockchain investigator Specter and follow up monitoring from security firms. Summary Wallets linked to Coinsbuy reportedly lost $7.9 million across Ethereum and TRON during Sunday’s drain. PeckShield traced stolen funds through ChangeNOW, FixedFloat and BingX after Specter first flagged the drain. ChangeNOW reportedly froze a six figure amount while attackers converted part of proceeds into Monero. Coinsbuy temporarily paused deposits and withdrawals after the incident before services reportedly resumed hours later. GoPlus said activity resembled compromised hot wallet keys or administrator access, though unconfirmed by Coinsbuy. The attacker then began routing part of the stolen assets through exchanges and toward Monero, a privacy focused cryptocurrency. PeckShield said the wallets “likely lost” about $7.9 million and traced part of the proceeds through ChangeNOW, FixedFloat and BingX. CertiK’s security feed independently relayed the same estimated loss and exchange routes. The precise attack vector has not been established publicly. You might also like: Coldcard attacker holds 1,159 BTC as mixing starts Coinsbuy drain spread across Ethereum and TRON Specter identified two Ethereum addresses and one TRON address as theft destinations. The cross network movement suggests the attacker obtained access capable of moving assets on more than one chain, but that does not establish whether private keys, administrator credentials or another part of Coinsbuy’s infrastructure was compromised. JUST IN: Coinsbuy wallet lose $7.9 million in cross-chain incident The event affected assets on TRON and Ethereum according to reports pic.twitter.com/L0eZSH05IN — crypto.news (@cryptodotnews) August 10, 2026 GoPlus Security said the activity was “consistent with hot wallet private key or administrator privilege theft.” That remains an assessment, not a confirmed root cause. Coinsbuy has not published a technical postmortem in the public documentation reviewed on Aug. 10. Its latest visible release notes are dated July 31. Coinsbuy describes itself as a business focused crypto payment service offering payment processing, wallet infrastructure and digital asset management. Its official site also advertises crypto payment processing and wallet services for businesses. Stolen funds moved through exchanges toward Monero After the drain, the attacker began sending stolen assets through exchange services. Specter said the funds were being converted toward Monero, while PeckShield identified ChangeNOW, FixedFloat and BingX among platforms receiving portions of the proceeds. Coinsbuy $7.9M drain sends funds through 3 exchanges, source: PeckShield Specter also said ChangeNOW helped freeze a six figure amount before it could move further. ChangeNOW had not issued a separate public statement confirming the exact frozen sum in sources reviewed for this story, so the amount remains attributed to the investigator. The laundering route resembles patterns seen in other major crypto thefts.