Coinsbuy Loses $7.9 Million in Cross-Chain Attack as Stolen Funds Race to Monero, Six Figures Frozen

Coinsbuy-linked wallets were drained of about $7.9 million across Ethereum and TRON, with the attacker moving stolen assets towards Monero before an exchange froze a six-figure portion of the funds.

The drain was flagged by on-chain analyst Specter at about 13:00 UTC on Aug. 9, according to reports citing blockchain transactions. Coinsbuy temporarily halted deposits and withdrawals after the incident and later restored services.

Ethereum And TRON Wallets Drained

Coinsbuy is a cryptocurrency payment platform that provides wallet and transaction infrastructure for businesses and other digital-asset users. The reported attack affected wallets linked to the platform across both Ethereum and TRON.

Blockchain monitors identified large transfers from the affected addresses after the drain was detected. The transactions show where the funds moved, but they do not establish how the attacker gained access.

The wallets reported in connection with the incident include two Ethereum addresses and a TRON address. Security researchers have not publicly confirmed whether private keys, credentials, API access or another mechanism was involved.

Stolen Funds Move Toward Monero

The attacker began routing portions of the stolen cryptocurrency through exchanges, with some funds eventually moved towards Monero, known by its ticker XMR.

Monero is designed to provide greater transaction privacy than transparent networks such as Ethereum. Moving stolen assets into XMR can therefore make conventional blockchain tracing more difficult.

Reports have also identified transfers involving ChangeNOW, FixedFloat and BingX. The full path of the funds remains unclear.

Exchange Freezes Six-Figure Amount

ChangeNOW reportedly froze a six-figure portion of the assets after the suspicious transfers were identified.

The amount frozen represents only part of the estimated $7.9 million drain. The exact sum has not been publicly disclosed in the reports reviewed.

The freeze came while the stolen funds were still moving between wallets and exchanges. That gave investigators and service providers an opportunity to identify and restrict at least some of the assets.

Coinsbuy Suspends Deposits And Withdrawals

Coinsbuy temporarily suspended deposits and withdrawals after the incident as it responded to the reported wallet drain.

The company’s platform supports cryptocurrency payments and transfers across multiple digital assets. Its published security information includes controls such as two-factor authentication, address whitelisting and withdrawal limits.

Services were later restored, according to reports. Coinsbuy has not publicly released a detailed technical post-mortem explaining the source of the compromise.

Attack Method Remains Unknown

No public investigation has established how the attacker obtained control of the affected wallets.

Possible explanations include compromised private keys, stolen credentials, API access or another form of unauthorized access. None has been confirmed publicly.

That distinction is important because the available blockchain evidence establishes the movement of funds, not the technical cause of the breach.

Blockchain Investigators Track The Money

The reported theft has remained visible through public blockchain transactions, allowing researchers to identify the affected addresses and follow subsequent transfers.

Specter‘s initial alert helped draw attention to the drain. PeckShield and other blockchain security monitors later amplified information about the stolen funds and their movement across networks.

The reported route into Monero has become a key part of the investigation because XMR’s privacy features can limit the usefulness of conventional transaction tracing.

Coinsbuy has restored its services, but the full amount recovered remains unclear. The technical cause of the wallet compromise has also not been disclosed.

The reported theft therefore leaves two central questions unresolved: how the attacker gained access and how much of the estimated $7.9 million can ultimately be recovered.