Crypto exchange Coinsbuy has suffered a coordinated security breach that drained more than $8 million in digital assets across the TRON and Ethereum blockchains, adding another major incident to an already costly year for crypto security.
Blockchain investigators linked activity on both networks to a single attacker after identifying connections between the transactions through a cross-chain swapping service.
The attack took place on August 9 and unfolded in less than an hour. Although Coinsbuy replenished the affected wallets within 24 hours, investigators have yet to determine exactly how the attacker gained access to the withdrawal process.
Attacker Drains $8.07 Million Across Two Blockchains
The incident initially appeared to involve separate attacks against Coinsbuy wallets on TRON and Ethereum.
According to on-chain data reviewed by security researchers, the attacker first conducted a small transaction involving just 5 USDT before beginning the larger withdrawals.
Eight wallets on the TRON network were subsequently drained of approximately 6.04 million USDT in roughly one hour.
At almost the same time, three Ethereum wallets lost approximately 1.89 million USDT and 77 ETH.
The Ethereum-side activity involved a wallet created on the same day as the attack. Funds were subsequently converted through decentralized exchange aggregator 1inch.
Together, the transactions resulted in losses of approximately $8.07 million.
Cross-Chain Activity Links the Attacks
The TRON and Ethereum withdrawals could initially have been interpreted as independent security incidents.
Blockchain analysis, however, identified a connection through Bridgers, a cross-chain swapping service.
The Ethereum payout contract associated with Bridgers sent funds directly into the Ethereum wallet involved in the swapping activity. That transaction helped researchers connect activity across both networks to the same operation.
The finding illustrates one of the advantages blockchain investigators have when analyzing cryptocurrency thefts.
Although attackers can distribute stolen assets across numerous wallets, blockchains maintain public transaction histories. Investigators can therefore follow transfers between addresses, protocols and networks to reconstruct how stolen funds move.
79% of Stolen Crypto Routed Through FixedFloat
After gaining control of the assets, the attacker quickly began moving a large portion of the stolen cryptocurrency.
Approximately 79% of the stolen funds were routed through instant cryptocurrency exchange FixedFloat.
Instead of using a small number of wallets, the attacker reportedly distributed transactions across roughly 50 single-use addresses.
Using numerous addresses can make investigations more complicated because analysts must follow multiple transaction paths rather than tracking one destination wallet.
However, blockchain records remain visible even when funds are divided across addresses.
Another exchange service, ChangeNOW, was contacted during the investigation and managed to freeze a six-figure amount connected to the incident.
Meanwhile, approximately 282 ETH — valued at roughly $542,000 at the time of reporting — remained unmoved across five addresses.
Coinsbuy Replenishes Affected Wallets
One of the most notable developments came after the attack.
Within approximately 24 hours, Coinsbuy replenished the drained wallets to within 0.05% of their balances before the incident.
Researchers believe that response could provide an important clue about what happened.
The rapid replenishment suggests Coinsbuy may not believe its private keys were compromised.
A private-key breach would typically represent a particularly serious security failure because anyone controlling a wallet's private key can authorize transactions from that wallet.
If the keys themselves remained secure, the attacker may instead have exploited another part of Coinsbuy's withdrawal infrastructure or internal systems.
However, this remains uncertain.
At the time of reporting, investigators had not established the attack vector, and Coinsbuy had not publicly explained how unauthorized withdrawals were possible.
Exact Cause of Coinsbuy Attack Remains Unknown
Determining the initial attack vector is now one of the most important unanswered questions.
The coordinated nature of the withdrawals indicates the attacker was able to target multiple wallets on two different blockchains in a short period.
Yet the rapid wallet replenishment complicates the picture.
Without an official post-mortem or technical explanation from Coinsbuy, it is not possible to conclude whether the incident resulted from compromised credentials, an internal vulnerability, withdrawal-system exploitation or another security failure.
That distinction matters because understanding the original weakness is necessary to determine whether the vulnerability has been completely addressed.
Crypto Industry Theft Nears $1 Billion
The Coinsbuy incident adds to mounting losses from cryptocurrency security breaches in 2026.
Approximately $972 million had already been stolen across the crypto sector through late July, according to figures cited in the original report.
The additional $8 million Coinsbuy incident pushes the industry's losses even higher and reinforces the continuing security challenges facing centralized platforms and blockchain applications.
Attackers have become increasingly sophisticated in moving funds between blockchains, decentralized exchanges and instant swap services.
At the same time, public blockchain infrastructure gives security researchers tools to trace transactions in real time and potentially alert services receiving stolen assets.
The freezing of part of the Coinsbuy funds demonstrates that tracing can sometimes help prevent attackers from successfully moving every stolen asset beyond recovery.
What Happens Next?
The immediate priority will be identifying how the attacker gained access to Coinsbuy's withdrawal infrastructure.
Investigators will also continue monitoring the roughly $542,000 in ETH that remained unmoved when the incident was reported.
Any movement from those addresses could provide additional information about the attacker's laundering strategy and potentially create opportunities for exchanges or other services to intercept funds.
Coinsbuy's decision to rapidly restore wallet balances is encouraging from a liquidity perspective, but it does not resolve the central security question.
Until the exchange or investigators establish and disclose the attack vector, uncertainty will remain over precisely how a single actor managed to coordinate an $8 million drain across both TRON and Ethereum.
The incident serves as another reminder that cross-chain infrastructure has made digital assets increasingly interconnected — both for legitimate users and for attackers attempting to move stolen cryptocurrency across networks.
