Coinsbuy — Coordinated Multi-Chain Hot Wallet Drain

August 9, 2026 — Coinsbuy, a B2B crypto payment processor, was drained of more than $7.9M across Ethereum and TRON in a coordinated multi-chain attack.

12:43:09 UTC: Attacker sends a 5 USDT test transaction on TRON from Coinsbuy main hot wallet — reconnaissance phase.

~13:00 UTC: Coordinated drain begins simultaneously on two chains: - TRON: 6,037,005 USDT extracted from 8 wallets within ~1 hour (largest single transfer: 3,492,005 USDT) - Ethereum: 1,890,000 USDT + 77 ETH extracted from 3 wallets in parallel

The two chains were linked via the Bridgers cross-chain swap service. ~79% of funds ($6.34M) immediately routed through FixedFloat using approximately 50 single-use addresses. A portion was sent via ChangeNOW before Specter Analyst detected the drain and alerted ChangeNOW — approximately $288K (~150 ETH) was frozen mid-transfer.

~13:00–18:00 UTC: Coinsbuy suspends deposits and withdrawals after detecting the drain.

Post-drain: Attacker converts remaining funds to Monero (XMR) via FixedFloat, BingX, and ChangeNOW to break the on-chain trail. 282.2 ETH remains immobile in 5 intermediate addresses.

00:36–01:09 UTC, Aug 10: Coinsbuy refills the drained wallets to within 0.05% of pre-attack balances (~$3.93M), demonstrating that private keys were not compromised — the attack vector was the withdrawal management system or admin access.

Aug 10: Coinsbuy publicly confirms the incident to Cointelegraph. Announces that all client funds are covered in full from company reserves ('No client has borne any loss'). Offers $100,000 bounty for information identifying the attacker.

Aug 11: Deposits and withdrawals fully resumed.

Aug 14: Rekt News publishes full analysis with BlockWatchdog figure of $8,073,992 (vs SlowMist $7.9M — retained). Attacker remains unidentified. Root cause not publicly disclosed by Coinsbuy.