The crypto exchange Coinsbuy lost about $8.07M in an attack across two networks at once — TRON and Ethereum. The withdrawal of funds was first reported by the Specter service, which estimated the damage at $7.9M. A detailed count of the transactions showed a larger sum — $8,073,992.
Coinsbuy has not yet issued an official statement, but within 12 hours of the theft the company topped up the affected addresses by approximately $3.93M. The accuracy of the reimbursement was within 0.05% of each of the lost amounts.
How the Coinsbuy hack unfolded
The attack unfolded on August 9, 2026, and took about an hour. The TRON network went into action first: at 12:43:09, the hacker made a test transfer of 5 USDT from Coinsbuy's main hot wallet. Two minutes later, the real amounts began.
By 13:44, the collector wallet had accumulated 6,037,005 USDT withdrawn from eight Coinsbuy addresses. The largest single withdrawal was 3,492,005 USDT.
In parallel, from 12:54 to 13:24, an attack was underway on Ethereum. 1,889,000 USDT and 77 ETH left three of the company's wallets. The hacker ran the resulting stablecoins through the 1inch aggregator and ended up with 981.1 ETH on a wallet created that same hour.
The link between the two threads of the attack was confirmed on-chain. At 14:09:18, the collector on TRON sent 100,000 USDT to the cross-chain exchanger Bridgers. After 14 and 23 minutes respectively, the Bridgers payment contract released 5.111 ETH and 46.027 ETH — to the same wallet that had been buying up ETH through 1inch. The total balance matches to within 0.16% (this is gas).
Where Coinsbuy's stolen money went
Another 150 ETH ($288K) passed through ChangeNOW — which reported freezing a six-figure sum. Meanwhile, 282.2 ETH ($542K) has been sitting untouched on five addresses since 15:51 on August 9 — as of the morning of the following day, the money had not moved.
The attack vector has not been established. On-chain analysis also did not reveal any overlap of addresses with the hacker who attacked the Triple-A service on July 24 — that one had a different laundering signature.
