How the Attack Unfolded: A Coordinated Cross-Chain Drain

The attack began with a test transaction of 5 USDT on the TRON network around 13:00 UTC on August 9 . Within roughly an hour, the attacker drained approximately $6.04 million in stablecoins from eight TRON wallets, with the single largest transaction amounting to about $3.5 million USDT . Simultaneously, three Ethereum wallets were emptied of $1.89 million USDT and 77 ETH, which was quickly swapped for ETH via the 1inch aggregator through a wallet created the same day .

The ability to access and drain wallets on two different blockchains in quick succession strongly suggests the attacker had compromised private keys or breached Coinsbuy's wallet infrastructure — not a smart contract exploit . On-chain records show the two chains were connected through the cross-chain swapper Bridgers, whose Ethereum payout contract received funds from the TRON side .

The Money Laundering: Monero as the Endgame

The attacker moved quickly to obscure the trail. Stolen funds were routed through three exchanges — ChangeNOW, FixedFloat, and BingX — and then converted into Monero (XMR), a privacy-focused cryptocurrency that makes forensic tracing significantly harder . This laundering sequence consumed the investigator window that might have enabled a larger freeze .

Detection and Response

On-chain monitoring firm Specter first flagged suspicious outflows and published an alert on its Telegram channel at approximately 13:00 UTC on August 9 . Blockchain security firm PeckShield independently confirmed the breach, tracing the flow of stolen funds and identifying the three exchanges involved .

Coinsbuy's response included:

• Temporarily suspending deposits and withdrawals immediately after the breach .
• Restoring services and stating it would cover all affected client funds from its own reserves .
• Offering a $100,000 bounty for information leading to the identification of those responsible .

ChangeNOW helped freeze a six-figure portion of the stolen assets, though the vast majority of funds had already moved .

The Broader Context: 2026 as a Record Year for Crypto Hacks

The Coinsbuy incident was not an isolated event. By the first half of 2026, crypto security firms were already reporting record numbers of hacks:

• Blockaid reported losses exceeding $1 billion across 212 verified incidents in H1 2026, calling it the "most-hacked half-year on record" by incident count .
• TRM Labs counted 207 separate hacks in H1 2026, the highest number it had recorded in any six-month period, with total losses of approximately $972 million .
• CertiK reported $1.315 billion stolen across 344 on-chain incidents in H1 2026, noting a 28% increase in net losses compared to the prior year when the $1.5 billion Bybit exploit was excluded .

North Korea-linked hackers, particularly the Lazarus Group, were responsible for approximately 55% of stolen value, and infrastructure/supply-chain attacks — not smart contract bugs — emerged as the dominant vector . Privileged key misuse alone accounted for roughly $790 million in losses in H1 2026 .

Full-year 2026 losses reached approximately $1.2 billion across 276 incidents, according to REKT's tracking, with the Coldcard hardware wallet breach alone accounting for about 10% of the total .

Key Takeaways

• Attack vector: A coordinated cross-chain drain, likely from compromised private keys or wallet infrastructure, not a smart contract exploit.
• Scale: ~$7.9 million stolen (some analysts report $8.07 million) across Ethereum and TRON .
• Laundering: Funds were routed through ChangeNOW, FixedFloat, and BingX, then converted to Monero (XMR) to resist tracing.
• Partial recovery: ChangeNOW froze a six-figure sum; Coinsbuy covered client losses from its own reserves.
• Record year: The attack fits a 2026 pattern of record-high hack frequency, with infrastructure and private-key compromises replacing smart contract exploits as the primary threat.

How the Attack Unfolded: A Coordinated Cross-Chain Drain

The attack began with a test transaction of 5 USDT on the TRON network around 13:00 UTC on August 9 . Within roughly an hour, the attacker drained approximately $6.04 million in stablecoins from eight TRON wallets, with the single largest transaction amounting to about $3.5 million USDT . Simultaneously, three Ethereum wallets were emptied of $1.89 million USDT and 77 ETH, which was quickly swapped for ETH via the 1inch aggregator through a wallet created the same day .

The ability to access and drain wallets on two different blockchains in quick succession strongly suggests the attacker had compromised private keys or breached Coinsbuy's wallet infrastructure — not a smart contract exploit . On-chain records show the two chains were connected through the cross-chain swapper Bridgers, whose Ethereum payout contract received funds from the TRON side .

The Money Laundering: Monero as the Endgame

The attacker moved quickly to obscure the trail. Stolen funds were routed through three exchanges — ChangeNOW, FixedFloat, and BingX — and then converted into Monero (XMR), a privacy-focused cryptocurrency that makes forensic tracing significantly harder . This laundering sequence consumed the investigator window that might have enabled a larger freeze .

Detection and Response

On-chain monitoring firm Specter first flagged suspicious outflows and published an alert on its Telegram channel at approximately 13:00 UTC on August 9 . Blockchain security firm PeckShield independently confirmed the breach, tracing the flow of stolen funds and identifying the three exchanges involved .

Coinsbuy's response included:

• Temporarily suspending deposits and withdrawals immediately after the breach .
• Restoring services and stating it would cover all affected client funds from its own reserves .
• Offering a $100,000 bounty for information leading to the identification of those responsible .

ChangeNOW helped freeze a six-figure portion of the stolen assets, though the vast majority of funds had already moved .

The Broader Context: 2026 as a Record Year for Crypto Hacks

The Coinsbuy incident was not an isolated event. By the first half of 2026, crypto security firms were already reporting record numbers of hacks:

• Blockaid reported losses exceeding $1 billion across 212 verified incidents in H1 2026, calling it the "most-hacked half-year on record" by incident count .
• TRM Labs counted 207 separate hacks in H1 2026, the highest number it had recorded in any six-month period, with total losses of approximately $972 million .
• CertiK reported $1.315 billion stolen across 344 on-chain incidents in H1 2026, noting a 28% increase in net losses compared to the prior year when the $1.5 billion Bybit exploit was excluded .

North Korea-linked hackers, particularly the Lazarus Group, were responsible for approximately 55% of stolen value, and infrastructure/supply-chain attacks — not smart contract bugs — emerged as the dominant vector . Privileged key misuse alone accounted for roughly $790 million in losses in H1 2026 .

Full-year 2026 losses reached approximately $1.2 billion across 276 incidents, according to REKT's tracking, with the Coldcard hardware wallet breach alone accounting for about 10% of the total .

Key Takeaways

• Attack vector: A coordinated cross-chain drain, likely from compromised private keys or wallet infrastructure, not a smart contract exploit.
• Scale: ~$7.9 million stolen (some analysts report $8.07 million) across Ethereum and TRON .
• Laundering: Funds were routed through ChangeNOW, FixedFloat, and BingX, then converted to Monero (XMR) to resist tracing.
• Partial recovery: ChangeNOW froze a six-figure sum; Coinsbuy covered client losses from its own reserves.
• Record year: The attack fits a 2026 pattern of record-high hack frequency, with infrastructure and private-key compromises replacing smart contract exploits as the primary threat.