Wallets linked to crypto payment processor Coinsbuy reportedly lost more than $7.9 million across Ethereum and TRON in a drain around 13:00 UTC on Aug. 9. PeckShield traced part of the stolen funds through three exchanges, while Specter said proceeds were being converted toward Monero. Coinsbuy briefly paused deposits and withdrawals before restoring service.
Wallets tied to Coinsbuy, a business-focused crypto payment service, lost more than $7.9 million across Ethereum and TRON in a reported drain around 13:00 UTC on Aug. 9, according to blockchain investigator Specter and follow-up monitoring from security firms.
PeckShield said the wallets likely lost about $7.9 million and traced part of the proceeds through ChangeNOW, FixedFloat and BingX. CertiK's security feed independently relayed the same estimated loss and exchange routes. The precise attack vector has not been established publicly.
Theft addresses span two networks
Specter identified two Ethereum addresses and one TRON address as the destinations for the stolen funds. The cross-network movement suggests the attacker gained access capable of moving assets on more than one chain, though that doesn't establish whether private keys, administrator credentials, or another part of Coinsbuy's infrastructure was compromised.
GoPlus Security said the activity was "consistent with hot wallet private key or administrator privilege theft." That remains an assessment, not a confirmed root cause. Coinsbuy has not published a technical postmortem in the public documentation reviewed on Aug. 10, and its latest visible release notes are dated July 31.
Funds routed toward Monero, partial freeze reported
Specter said the attacker began converting part of the stolen assets toward Monero, a privacy-focused cryptocurrency, after routing them through exchange services. The investigator added that ChangeNOW helped freeze a six-figure amount before it could move further, though ChangeNOW has not issued a separate public statement confirming the exact frozen sum.
Deposits resume as loss breakdown stays unclear
Coinsbuy paused deposits and withdrawals after the incident and later restored them, according to Specter's update. It remains unclear whether the reported $7.9 million consisted of Coinsbuy-owned assets, client funds, or a mix of both, and no customer loss breakdown or reimbursement plan was visible in the company materials reviewed on Aug. 10.
The case adds to a busy year for crypto security: TRM Labs recorded 207 hacks and about $972 million stolen during the first half of 2026, with infrastructure and operational failures accounting for most of the value lost.
Security researchers are continuing to trace the listed addresses, though movement into Monero can make later tracing harder once funds leave transparent blockchains.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
