On August 9, 2026, hackers drained $8.07 million from the Coinsbuy cryptocurrency exchange across the TRON and Ethereum blockchains. The attacker used the cross-chain swapper Bridgers to link the operations and laundered 79% of the funds through FixedFloat. Coinsbuy quickly replenished the affected wallets from its own reserves, suggesting its private keys were not compromised. Coinsbuy is offering a $100,000 bounty to identify the hackers.
Coinsbuy exchange attack mechanics
- ▪The attacker initiated the exploit with a 5 USDT test transaction on the TRON network before draining 6.04 million USDT from eight Coinsbuy wallets.
- ▪Blockchain security researchers linked the TRON and Ethereum transactions to a single attacker through the cross-chain swapper Bridgers.
- ▪On August 9, 2026, an attacker drained $8.07 million from the Coinsbuy cryptocurrency exchange across the TRON and Ethereum blockchains.
- ▪On the Ethereum network, the attacker simultaneously drained 1.89 million USDT and 77 ETH from three Coinsbuy wallets.
FixedFloat laundering operations
- ▪The attacker routed approximately 79% of the stolen funds, totaling about $6.34 million, through the instant exchange FixedFloat using roughly 50 single-use addresses.
- ▪The cryptocurrency exchange ChangeNOW froze a six-figure sum of the stolen funds after being contacted by Specter Investigations.
- ▪Approximately 282 ETH, valued at around $542,000, remained unmoved across five addresses following the August 9, 2026 attack.
Wallet refill strategy
- ▪Within 24 hours of the August 9, 2026 attack, Coinsbuy replenished the affected wallets to within 0.05% of their pre-attack balances using its own reserves.
- ▪Coinsbuy stated that all affected client funds were fully covered from its reserves, resulting in zero financial losses for its users.
Private key security analysis
- ▪Blockchain investigator BlockWatchdog stated that the attack likely targeted a withdrawal path sitting above the private keys rather than the keys themselves.
- ▪Blockchain security researchers noted that Coinsbuy's rapid replenishment of the same wallets suggests the underlying private keys were not compromised.
Coinsbuy investigation bounty
- ▪Coinsbuy launched an initiative offering a $100,000 reward for information leading to the identification of those responsible for the August 9, 2026 attack.
- ▪Coinsbuy offered an additional bonus for any assistance leading to the recovery of the stolen funds.
2026 crypto hack losses
- ▪The Coinsbuy incident occurred amid a broader trend of crypto hacks in 2026, which saw roughly $972 million stolen across the sector through late July 2026.
- ▪DeFi protocols lost more than $840 million to exploits in the first five months of 2026, according to DeFiLlama.
- ▪In July 2026, attackers stole $24 million from Arbitrum-based AFX Trade and $18 million from decentralized exchange Ostium.
Story comments
Loading comments…