Wallets linked to crypto payment processor Coinsbuy were reportedly drained of more than $7.9 million across Ethereum and TRON around 13:00 UTC on Aug. 9, according to blockchain investigator Specter and follow up monitoring from security firms.
Summary
- Wallets linked to Coinsbuy reportedly lost $7.9 million across Ethereum and TRON during Sunday’s drain.
- PeckShield traced stolen funds through ChangeNOW, FixedFloat and BingX after Specter first flagged the drain.
- ChangeNOW reportedly froze a six figure amount while attackers converted part of proceeds into Monero.
- Coinsbuy temporarily paused deposits and withdrawals after the incident before services reportedly resumed hours later.
- GoPlus said activity resembled compromised hot wallet keys or administrator access, though unconfirmed by Coinsbuy.
The attacker then began routing part of the stolen assets through exchanges and toward Monero, a privacy focused cryptocurrency.
PeckShield said the wallets “likely lost” about $7.9 million and traced part of the proceeds through ChangeNOW, FixedFloat and BingX. CertiK’s security feed independently relayed the same estimated loss and exchange routes. The precise attack vector has not been established publicly.
Coinsbuy drain spread across Ethereum and TRON
Specter identified two Ethereum addresses and one TRON address as theft destinations. The cross network movement suggests the attacker obtained access capable of moving assets on more than one chain, but that does not establish whether private keys, administrator credentials or another part of Coinsbuy’s infrastructure was compromised.
GoPlus Security said the activity was “consistent with hot wallet private key or administrator privilege theft.” That remains an assessment, not a confirmed root cause. Coinsbuy has not published a technical postmortem in the public documentation reviewed on Aug. 10. Its latest visible release notes are dated July 31.
Coinsbuy describes itself as a business focused crypto payment service offering payment processing, wallet infrastructure and digital asset management. Its official site also advertises crypto payment processing and wallet services for businesses.
Stolen funds moved through exchanges toward Monero
After the drain, the attacker began sending stolen assets through exchange services. Specter said the funds were being converted toward Monero, while PeckShield identified ChangeNOW, FixedFloat and BingX among platforms receiving portions of the proceeds.
Specter also said ChangeNOW helped freeze a six figure amount before it could move further. ChangeNOW had not issued a separate public statement confirming the exact frozen sum in sources reviewed for this story, so the amount remains attributed to the investigator.
The laundering route resembles patterns seen in other major crypto thefts. In an earlier recovery case, investigators helped freeze about $1.2 million tied to Bo Shen’s stolen assets after funds passed through services including ChangeNOW. Separately, a January wallet theft involved attackers converting stolen Bitcoin and Litecoin into Monero.
Deposits and withdrawals reportedly resumed
Coinsbuy paused deposits and withdrawals after the incident and later restored them, according to Specter’s update and reports citing the investigator. No separate incident notice confirming the timeline was visible in Coinsbuy’s public release notes at the time of review.
It also remains unclear from public disclosures whether the reported $7.9 million consisted entirely of Coinsbuy owned assets, client funds or a combination of both. No customer loss breakdown or reimbursement plan was visible in the company materials reviewed on Aug. 10.
That distinction matters because service restoration does not establish that the investigation is complete or that the full loss has been recovered. The currently verified public picture remains limited to the reported drain, identified theft addresses, laundering activity and a partial freeze.
The case adds to a busy security year. TRM Labs recorded 207 hacks and about $972 million stolen during the first half of 2026, according to data cited in recent industry loss coverage. Infrastructure and operational failures accounted for most of the value lost during that period.
What happens next
The next material update would be a Coinsbuy incident report identifying the attack vector, affected assets, final loss and any customer exposure. Confirmation from ChangeNOW or the other exchanges could also clarify how much was frozen and whether additional funds remain recoverable.
For now, claims about how the attacker obtained access should remain qualified. Security researchers are continuing to trace the listed Ethereum and TRON addresses, but movement into Monero can make later tracing harder once funds leave transparent blockchains.
