Coinsbuy Suffers $7.9 Million Cross-Chain Hack with Funds Laundered Through Monero

Aug 10, 2026

Crypto payment processor Coinsbuy suffered its first known security breach on August 9, 2026, when attackers drained approximately $7.9 million across Ethereum and TRON networks. The hacker routed the stolen assets through exchanges like ChangeNOW, FixedFloat, and BingX to convert them into the privacy coin Monero, complicating tracing efforts. While ChangeNOW successfully froze a six-figure portion of the funds, the majority remains unrecovered. Coinsbuy temporarily paused and subsequently restored its services.

Coinsbuy cross-chain hack

▪Wallets linked to the crypto payment processor Coinsbuy were drained of approximately $7.9 million across the Ethereum and TRON networks around 13:00 UTC on August 9, 2026.
▪The Coinsbuy security breach represents the first publicly known hack of the business-focused payment platform since its launch in approximately 2019.

Monero laundering operations

▪The attacker routed the stolen Coinsbuy assets through exchanges, including ChangeNOW, FixedFloat, and BingX, to convert them into the privacy-focused cryptocurrency Monero.
▪Security researchers noted that converting the stolen assets into Monero significantly hinders transaction tracing due to Monero's privacy architecture obscuring transaction amounts, senders, and recipients.

ChangeNOW fund freezing

▪The exact frozen balance recovered through ChangeNOW remains unconfirmed by Coinsbuy, and the vast majority of the $7.9 million in stolen assets remains unrecovered.
▪The non-custodial cryptocurrency exchange ChangeNOW assisted in freezing a six-figure portion of the stolen Coinsbuy assets before they could be fully converted or withdrawn.

Service suspension response

▪Coinsbuy temporarily suspended all deposit and withdrawal services immediately following the August 9, 2026, exploit to prevent further unauthorized activity.
▪Coinsbuy restored its deposit and withdrawal services a few hours after the suspension, though the platform did not immediately publish a detailed technical postmortem.

Compromised wallet access

▪On-chain investigator Specter identified two specific Ethereum addresses and one TRON address that served as the destination wallets for the stolen Coinsbuy funds.
▪Blockchain security firm GoPlus Security assessed that the Coinsbuy exploit was consistent with compromised hot wallet private keys or administrator privilege theft.