Coinsbuy drained of $8.07M across TRON and Ethereum; wallets refilled within a day, no statement

Payments-focused crypto exchange Coinsbuy lost roughly $8.07 million on Aug. 9 in what onchain researchers describe as a single coordinated operation spanning two blockchains, CoinDesk reported Aug. 10, citing onchain data reviewed by blockchain security researchers it did not name.

The sequence, per those records: the attacker sent a 5 USDT test transaction, then emptied eight TRON wallets of 6.04 million USDT over about an hour. Three Ethereum wallets were drained simultaneously of 1.89 million USDT and 77 ETH, with proceeds swapped to ETH through 1inch via a wallet created that same day. The two legs looked separate until researchers traced them to cross-chain swapper Bridgers, whose Ethereum payout contract fed directly into the Ethereum swap wallet — the link that turned two incidents into one.

Laundering was fast and largely automated. About 79% of the funds — roughly $6.4 million on CoinDesk's own total — moved through instant exchange FixedFloat across some 50 single-use addresses. ChangeNOW froze a six-figure sum after being contacted by Specter Investigations. Around 282 ETH, about $542,000, sits unmoved across five addresses.

Then the part worth pausing on: within 24 hours, Coinsbuy refilled the drained wallets to within 0.05% of their pre-attack balances. Researchers cited by CoinDesk read that as evidence the team does not believe its private keys were compromised. The attack vector has not been established, and Coinsbuy has not issued a public statement. CoinDesk said it emailed the company for comment.

Key facts

• $8.07 million drained from Coinsbuy on Aug. 9 across TRON and Ethereum, in under an hour — CoinDesk, citing onchain data reviewed by security researchers.
• 6.04 million USDT from eight TRON wallets; 1.89 million USDT and 77 ETH from three Ethereum wallets — same source. Those components reconcile with the $8.07M headline at the ~$1,920/ETH implied by the report's own figures.
• ~79% of funds routed via FixedFloat through ~50 single-use addresses; ChangeNOW froze a six-figure amount after contact from Specter Investigations — CoinDesk.
• 282 ETH (~$542,000) unmoved across five addresses — CoinDesk.
• Wallets refilled to within 0.05% of pre-attack balances inside 24 hours — CoinDesk.
• ~$972 million stolen sector-wide through late July 2026 — CoinDesk, attribution for that tally not specified.

The real-world read

The refill is the story Coinsbuy isn't telling. Restoring balances to within 0.05% inside a day means the exchange had the capital and the key access to do it — and that customer-facing balances now look untouched while the intrusion path remains unexplained. Silence plus a fast top-up is a combination that keeps users calm and keeps questions unasked.

The "keys weren't compromised" line is an inference by unnamed researchers, not a finding, and Coinsbuy has confirmed nothing. That leaves the more uncomfortable possibilities open: a compromised withdrawal path, internal tooling, or an authorized signer. The 5 USDT probe and the synchronized cross-chain execution point to an attacker who already knew where the money was.

Two loose threads: the description of the Ethereum leg — 1.89M USDT and 77 ETH, "swapped to ETH" — is internally muddled, and no researcher or firm behind the core forensics is named. Only Specter Investigations is identified, and only for the ChangeNOW freeze.

Opinion, and whose

• Researchers cited by CoinDesk: the rapid refill indicates the team does not believe private keys were compromised. Their read, not a confirmed conclusion.
• CoinDesk: frames the incident as adding to an "increasingly costly year" for crypto security.
• Coinsbuy: no stated position. It has said nothing publicly.

Sources

• CoinDesk (Aug. 10, 2026), "Crypto exchange Coinsbuy loses $8 million in coordinated two-blockchain attack," with additional reporting by Ollie Acuna — the sole account here, and a secondary one: it relays onchain data reviewed by unnamed blockchain security researchers, names Specter Investigations for the ChangeNOW freeze, and reports Coinsbuy did not respond before publication. No primary filing, exchange statement, or forensic report is available yet, and none of the material here is sponsored or promotional.

Nothing here is financial advice.