Wallets associated with the cryptocurrency payments platform Coinsbuy were drained of more than $7.9 million across the Ethereum and TRON networks in a coordinated incident that began around 13:00 UTC on August 9, 2026.
On-chain monitoring, first flagged by investigator SpecterAnalyst on Telegram, revealed unusual outflows from addresses linked to the B2B crypto processor, which primarily serves businesses, merchants, and exchanges.
The attacker moved quickly to convert the stolen assets. Funds were routed through multiple exchanges and mixed into Monero (XMR) in an apparent effort to obscure the trail.
ChangeNOW reportedly assisted by freezing a six-figure portion of the proceeds, limiting the full scope of the loss. In response, Coinsbuy temporarily suspended deposits and withdrawals while it assessed the situation. Services have since been restored, according to reports circulating among blockchain security observers.
Security firms including PeckShield and GoPlus Security corroborated the scale of the drain and identified the primary theft addresses: two on Ethereum (0x4d1…61d3 and 0x6679…4b17) and one on TRON (TVpX9…ubGR).
Onchain transactions data from Etherscan shows that funds were moved across multiple addresses in an attempt to erase tracing (the technique often called layering). The status of funds on Ethereum currently remains uncertain.
The stolen funds include at least 77 ETH and about 1.4 million USDT from one hot wallet plus hundreds of thousands more in USDT from others. The assets were then swapped via 1inch into ETH, split into 20–100 ETH chunks across more than 30 vanity wallets, according to onchain analyst CryptoEights.
Multiple investigators noted that the simultaneous activity on two separate blockchains points to possible compromise of hot-wallet private keys or elevated administrative privileges rather than an isolated smart-contract exploit.
Rapid Laundering and Limited Recovery
The speed of the laundering attempt underscores ongoing challenges in tracking cross-chain thefts. By funneling assets toward privacy-focused Monero through instant-exchange services such as ChangeNOW, FixedFloat, and BingX, the perpetrator sought to break the on-chain trail before freezes could fully take effect.
The partial success of the freeze demonstrates the value of rapid cooperation between investigators and centralized platforms, yet the majority of the funds remain unrecovered at the time of reporting.
Coinsbuy’s developer documentation continues to receive updates despite limited public activity on its social channels, suggesting the platform remains operational for enterprise clients.
The incident adds to a series of high-value crypto payment processor breaches in recent years and highlights persistent risks around fund consolidation logic and multi-network wallet management. Blockchain security teams continue to monitor the identified addresses for further movement while the platform works to strengthen its internal controls.
Update (11:30 AM UTC – August 11, 2026):
In a comment shared with The Crypto Times, Coinsbuy team said that the issue has been contained, with immediate steps taken to secure the platform.
“All affected client funds have been fully covered by Coinsbuy from our own reserves, so our users have not experienced any financial losses. The platform is back to operating normally, with all services fully available,” the statement reads, adding, “Our team is conducting a thorough investigation to establish exactly what happened. To ensure the integrity of this process, we are not sharing technical details at this stage. We will provide another update once the investigation has been completed and its findings have been verified.”
The Coinsbuy team also emphasized its commitment to protecting users and the platform’s reliability. Additionally, the team has launched a $100,000 reward for information leading to the identification of those responsible, with a further bonus offered for assistance that results in the recovery of the stolen funds. Anyone with relevant information is encouraged to contact the team at compliance@coinsbuy.com.
Also read: Bybit Sues North Korea Over $1.5B Hack, Secures Court-Ordered Asset Freeze
