Wallets linked to crypto payments provider Coinsbuy lost more than $7.9 million across Ethereum and TRON in a cross-chain drain, with stolen assets subsequently routed through exchanges and converted into Monero.
Onchain investigator Specter traced the suspicious outflows at around 13:00 UTC on August 9. Coinsbuy temporarily suspended deposits and withdrawals after the theft before restoring both services. A six-figure portion of the stolen assets was frozen with assistance from ChangeNOW.
The attack vector has not been publicly identified. The available evidence points to compromised Coinsbuy-linked wallets rather than a breach of the Ethereum or TRON networks themselves.
Stolen Funds Routed Through Exchanges Into Monero
The stolen assets moved from the affected wallets through multiple exchange services as the operator began converting part of the proceeds into XMR. ChangeNOW, FixedFloat and BingX were among the venues identified along the subsequent transaction path.
Monero complicates public tracing because its privacy architecture obscures transaction amounts, sender addresses and recipients once funds enter the network. The identifiable blockchain trail therefore becomes substantially more limited after an exchange completes an XMR conversion.
ChangeNOW intervened before all of the tracked assets could leave its platform, freezing an amount described only as six figures. Coinsbuy has not disclosed the exact recovered balance or how much of the $7.9 million remains traceable.
The company’s platform provides crypto payment processing and wallet infrastructure to merchants, exchanges and other businesses, including custody, deposits and automated withdrawals across multiple blockchains.
Cross-Chain Drain Follows Triple-A Theft
The Coinsbuy theft closely follows a $9.7 million drain from Triple-A-linked wallets that Specter traced across TRON, Ethereum, Polygon and Arbitrum. Those funds were bridged and consolidated into ETH before part of the balance later moved through privacy infrastructure.
Both cases involved funds leaving wallets associated with crypto payments companies across multiple networks, although no evidence currently connects the attackers or establishes a common compromise method.
The losses extend a period of elevated crypto theft after 30 major hacks removed $210.3 million in July, a 177.2% increase from June.
Coldcard Losses Add To Security Pressure
Wallet security has remained under particular scrutiny after Coldcard-linked Bitcoin thefts expanded to as much as $132 million. Galaxy Research identified at least 15 suspected attackers targeting seeds generated with vulnerable Coldcard firmware, with thousands of addresses implicated in the wider drain.
The Coinsbuy case differs because no seed-generation, smart-contract or software vulnerability has yet been identified. Its immediate operational disruption has ended, with deposits and withdrawals restored after the temporary suspension.
ChangeNOW’s freeze remains the only publicly disclosed recovery action, while the total identified loss remains above $7.9 million.
Be the first to comment