Coinsbuy exchange drained of $7.9–8M in coordinated attack across Ethereum and TRON blockchains, with funds routed through FixedFloat toward Monero.
Security & Exploits ·
An attacker drained $8.07 million from the crypto payments platform Coinsbuy across TRON and Ethereum blockchains within an hour on August 9. Researchers traced the operation to a single actor who exploited cross-chain infrastructure to link wallet drains on both networks, routing approximately 79% of the stolen assets through the instant exchange FixedFloat via roughly 50 newly created addresses. Around $542,000 in Ethereum tokens remain stationary across five wallets, while ChangeNOW froze a six-figure sum after being notified.
The incident appears to have bypassed private key compromise, as Coinsbuy refilled affected wallets to nearly their pre-attack levels within 24 hours. The exchange stated it absorbed all losses from company reserves and that operations remain stable, though the specific entry point the attacker exploited has not been disclosed. Coinsbuy announced a $100,000bounty for information leading to recovery or identification of those responsible.
The timing and execution highlight persistent vulnerabilities in custody infrastructure, even among established platforms. Whether the breach stemmed from compromised API credentials, session hijacking, or another withdrawal mechanism remains unclear, and Coinsbuy has declined to release technical details pending further investigation.