Crypto exchange Coinsbuy sustained losses exceeding $8 million after attackers exploited its accounts on the TRON and Ethereum blockchains on August 9, according to on-chain transaction records and an ongoing investigation.

The attack began with a minor transfer of 5 USDT before escalating rapidly. Such small initial transactions are a commonly observed reconnaissance technique in crypto thefts, used by attackers to confirm access and test whether transfers will execute before committing to larger withdrawals. Within approximately one hour, the attacker drained roughly $6.04 million in stablecoins from eight wallets on the TRON network. The operation was then followed by additional transactions on Ethereum, involving approximately $1.89 million in USDT and 77 ETH taken from three wallets.

Stolen assets on Ethereum were quickly converted into ETH through the 1inch wallet, complicating the movement of funds and expanding the number of addresses and services involved in tracing the stolen cryptocurrency. The total amount drained across TRON and Ethereum exceeded $8 million, with investigators subsequently tracking the funds through cross-chain and instant-exchange services.

Investigators Link TRON and Ethereum Transactions

On-chain investigators identified a connection between the two networks through a cross-chain swapping service called Bridgers. Transaction records indicated that the service used an Ethereum payment contract to send funds directly to an Ethereum swap wallet associated with the attacker.

This link helped investigators connect transactions that initially appeared to be separate operations on different blockchains. The finding demonstrates how attackers can move assets between networks and services to complicate investigations and obscure the trail of stolen funds.

The attacker subsequently routed approximately 79% of the stolen cryptocurrency through the instant exchange FixedFloat, using roughly 50 different wallets. Instant exchange services like FixedFloat and ChangeNOW have been frequently used in past laundering operations because they typically require less stringent identity verification than regulated exchanges, making them attractive for obscuring fund origins. Investigators also notified ChangeNOW about the stolen funds, leading to the freezing of a six-figure amount. Around 282 ETH, valued at approximately $542,000 at the time of the report, remained untouched across five accounts. Investigators continued monitoring those addresses for any further movement.

Coinsbuy Replenishes Affected Accounts

Within 24 hours of the attack, Coinsbuy had replenished the affected accounts to within 0.05% of their previous balances. The rapid restoration was viewed as an indication that the attackers may not have obtained the private keys associated with the wallets.

However, the precise attack vector had not yet been established. Determining how the attackers gained the ability to transfer the funds remains a central focus of the investigation, particularly because the movement of assets across multiple wallets and blockchain networks could have involved a vulnerability or a compromised access mechanism.

Coinsbuy stated that its customers had not suffered losses and that the platform remained stable and operational while the investigation continued. The exchange also indicated it was withholding additional technical information while investigators worked to determine the circumstances of the breach.

Coinsbuy has offered a reward of up to $100,000 for information leading to the identification of those responsible, with an additional reward available if the stolen funds are recovered.

https://x.com/BlockWatchdog/status/2086693306851840323?ref_src=twsrc%5Etfw

Crypto Security Risks Remain Elevated

The Coinsbuy incident comes amid a broader rise in cryptocurrency security breaches. Blockchain security data indicated that crypto-related losses reached approximately $1 billion during the first half of 2026, while the sector recorded its highest number of hacks for a six-month period.

Ethereum and Solana accounted for the largest reported losses among blockchain networks during that period. Ethereum-related attacks resulted in approximately $332 million in losses, while Solana-based incidents accounted for about $326 million.

The causes differed between the two networks: Ethereum losses were largely linked to code exploitation, while attacks involving Solana were associated with compromised keys and signing infrastructure.

The Coinsbuy breach highlights the growing complexity of attacks involving multiple blockchains and financial services. Moving stolen assets through cross-chain systems, decentralized wallets, and instant exchanges can create additional challenges for investigators seeking to freeze funds. The involvement of the TRON network adds further complexity, as TRON's lower transaction fees and high throughput have made it a frequently used network for stablecoin transfers and, consequently, for moving illicit proceeds.

For exchanges, the incident underscores the importance of wallet security, transaction monitoring, and rapid coordination with blockchain analytics firms and other crypto service providers. Coinsbuy's decision to replenish affected accounts and offer a substantial recovery reward indicates that the exchange is seeking to contain the financial and operational impact while the investigation proceeds.

The case remains unresolved, with the method used to gain unauthorized control of the affected wallets still unknown and some stolen funds continuing to sit in monitored addresses.