Hackers Steal $8 Million from Crypto Exchange on Two Blockchains

Crypto Platform Coinsbuy Loses Over $8 Million in Sunday Heist

An attacker siphoned more than $8 million from the cryptocurrency platform Coinsbuy across the Tron and Ethereum networks on Sunday, subsequently moving the majority of the stolen assets, according to an analysis by blockchain investigator BlockWatchdog.

In a report published on X, BlockWatchdog detailed that the attack commenced on the Tron network with a single 5 USDT test transaction. Minutes later, over 6 million USDT was drained from eight Coinsbuy wallets. On the Ethereum network, an additional 1.89 million USDT and 77 ETH were taken from three separate wallets.

BlockWatchdog identified the same attacker behind both the Tron and Ethereum transactions, linking them through the cross-chain swap service Bridgers. The perpetrator then laundered approximately $6.34 million, representing 79% of the total stolen funds, through the FixedFloat cryptocurrency exchange. A further 150 ETH was routed via ChangeNOW.

According to BlockWatchdog’s findings, an additional 282.2 ETH, valued at roughly $542,000 at the time of the incident, remained untouched across five distinct addresses.

Hours after the theft, Coinsbuy replenished the affected wallets. BlockWatchdog reported that approximately $3.93 million was returned to the same 10 addresses, with seven of these deposits matching the original stolen amounts to within 0.05%.

“That only makes sense if the team does not believe the private keys leaked,” BlockWatchdog stated. “An address is a key: nobody tops up a compromised wallet with seven figures twice in one night. Whatever was taken over on 9 August sat above the keys—the withdrawal path that uses them.”

While the precise method of the attack remains undisclosed, BlockWatchdog suggested that the attacker may have gained unauthorized access to Coinsbuy’s withdrawal system.

“Nothing on-chain shows how the withdrawal path was reached—the refill argues against key theft, it does not name what replaced it,” the investigators wrote. “No attribution either: zero address overlap with the Triple-A attacker of 24 July, and a different laundering habit.”

BlockWatchdog also noted a lack of address overlap with the attacker responsible for the July 24 Triple-A hack, observing distinct laundering patterns in this latest incident.

At the time of BlockWatchdog’s analysis, Coinsbuy had not publicly disclosed how the attacker managed to gain access.

Coinsbuy did not immediately respond to a request for comment from Decrypt.

This incident occurs amidst a recent surge in significant cryptocurrency hacks. DeFi protocols have lost over $840 million to exploits in the first five months of 2026, according to data from DeFiLlama. In July, attackers stole $24 million from Arbitrum-based AFX Trade by exploiting a bridge operated by the decentralized exchange. Earlier that same month, decentralized exchange Ostium lost $18 million after an attacker compromised an oracle key.