CoinDesk
Coinsbuy lost $8.07 million in under an hour on Aug. 9 after an attacker drained eight TRON wallets and three Ethereum wallets. The haul included 6.04 million USDT on TRON, plus 1.89 million USDT and 77 ETH on Ethereum. Onchain records linked the operations through Bridgers, a cross-chain swapper, whose Ethereum payout contract sent funds into a wallet created the same day.
Why it matters
About 79% of the stolen funds moved through FixedFloat via roughly 50 single-use addresses. The attacker began with a 5 USDT transfer before the larger withdrawals. ChangeNOW froze a six-figure sum after Specter Investigations made contact, while 282 ETH, worth about $542,000, remains unmoved across five addresses. The routing connected what initially appeared to be separate chain-specific drains.
Coinsbuy refilled the drained wallets within 24 hours to within 0.05% of their pre-attack balances. Researchers read that as a sign the exchange did not believe private keys were compromised, but the attack vector remains unknown and Coinsbuy has not publicly explained how the withdrawal path was accessed.
Market impact
The broader risk is operational, not limited to one token or chain. The incident puts withdrawal authorization, cross-chain settlement and instant-exchange controls under scrutiny after the attacker split activity across TRON and Ethereum.
Roughly $972 million had already been stolen across the sector through late July. Frozen and unmoved funds provide a recovery path, but the unresolved access method leaves the central security question unanswered.
Frequently asked questions
-
How were the TRON and Ethereum drains linked?
Onchain records tied the drains through Bridgers, whose Ethereum payout contract sent funds into a wallet created the same day.
-
How did the attacker move most of the stolen funds?
About 79% moved through FixedFloat via roughly 50 single-use addresses.
-
How much of the stolen ETH remains unmoved?
Around 282 ETH, worth about $542,000, remains unmoved across five addresses.
-
Why did Coinsbuy's rapid wallet refill matter?
Coinsbuy restored the drained wallets within 24 hours to within 0.05% of their pre-attack balances. Researchers read that refill as a sign that private keys were not compromised.
-
Why does the incident matter to other exchanges?
The unresolved access method puts withdrawal authorization, cross-chain settlement and instant-exchange controls under scrutiny. The operation split activity across TRON and Ethereum.
TheBlock
CryptoSlate
CoinTelegraph
WuBlockchain