TL;DR
- The $8.07 million crypto exchange heist drained Coinsbuy wallets across Tron and Ethereum on August 9.
- Around $6.34 million, or 79% of the stolen funds, moved through FixedFloat, while additional ETH passed through ChangeNOW.
- Coinsbuy replenished affected wallets from its own reserves, suggesting the incident may have involved the withdrawal system rather than a direct private-key compromise.
The $8.07 million crypto exchange heist at Coinsbuy involved assets across Tron and Ethereum on August 9, with the attacker moving most of the stolen funds through cross-chain infrastructure and cryptocurrency exchanges. Coinsbuy said the incident was contained and that customer balances were fully covered by company reserves.
🔴 COINSBUY — $8.07M drained
Coinsbuy refilled the wallets it was robbed from. 12 hours later $3.93M went back into the same ten addresses — seven matched to within 0.05% of each loss. It is still sitting there.
That only makes sense if the team does not believe the private…
— BlockWatchdog (@BlockWatchdog) August 10, 2026
The attacker began with a 5 USDT test transaction on Tron before draining more than $6.34 million from eight Coinsbuy wallets. On Ethereum, another $1.89 million in USDT and 77 ETH were taken from three addresses. Blockchain investigator BlockWatchdog linked the transactions through Bridgers, a cross-chain swap service.
Crypto Exchange Heist Reveals A Multi-Chain Withdrawal Route
About $6.34 million, representing 79% of the stolen funds, later passed through FixedFloat, while another 150 ETH moved through ChangeNOW. BlockWatchdog also identified 282.2 ETH worth approximately $542,000 at the time of the attack that remained across five addresses.
The wallet replenishments provide an important clue about the potential attack vector. Coinsbuy restored approximately $3.93 million to the same 10 addresses, with seven deposits reportedly matching the amounts originally stolen within 0.05%. BlockWatchdog said this behavior points away from a direct private-key compromise and toward a possible weakness in the exchange’s withdrawal process.
That distinction matters for crypto infrastructure because public blockchains create transparent transaction trails that investigators can follow across networks. Tron and Ethereum allowed analysts to track movements between wallets, bridges and exchanges, providing information that can support investigations without relying exclusively on internal company records.
Crypto Security Pressure Grows Across The Industry
The Coinsbuy breach arrives during a period of elevated security activity across digital assets. DeFiLlama data cited in recent industry reporting shows that DeFi protocols lost more than $840 million to hacks during the first five months of 2026. Other incidents have targeted bridges, oracle infrastructure and exchange systems.
For crypto users, the response also illustrates an important advantage of open blockchain infrastructure. Tron and Ethereum provided publicly accessible records of fund movements, allowing investigators to trace transactions across addresses and services while exchanges worked internally to contain the breach.
