An attacker drained more than $8 million from crypto platform Coinsbuy across the Tron and Ethereum networks on Sunday before moving most of the stolen funds, according to an analysis by blockchain investigator BlockWatchdog.

In a report posted on X, BlockWatchdog said the attack began on Tron with a 5 USDT test transaction. Minutes later, more than 6 million USDT was drained from eight Coinsbuy wallets. On Ethereum, another 1.89 million USDT and 77 ETH were taken from three wallets.



BlockWatchdog linked the Tron and Ethereum transactions to the same attacker through cross-chain swap service Bridgers. The attacker then moved about $6.34 million, or 79% of the stolen funds, through the FixedFloat cryptocurrency exchange. Another 150 ETH was sent through ChangeNOW.

According to BlockWatchdog, another 282.2 ETH, worth about $542,000 at the time of the attack, remained untouched across five addresses.

Hours after the theft, Coinsbuy replenished the affected wallets, with BlockWatchdog reporting that around $3.93 million was returned to the same 10 addresses, with seven deposits matching the amounts originally stolen to within 0.05%.

“That only makes sense if the team does not believe the private keys leaked,” BlockWatchdog wrote. “An address is a key: nobody tops up a compromised wallet with seven figures twice in one night. Whatever was taken over on 9 August sat above the keys—the withdrawal path that uses them.”

While the exact attack vector is unknown, BlockWatchdog said the attacker may have gained access to Coinsbuy’s withdrawal system.

“Nothing on-chain shows how the withdrawal path was reached—the refill argues against key theft, it does not name what replaced it,” they wrote. “No attribution either: zero address overlap with the Triple-A attacker of 24 July, and a different laundering habit.”

BlockWatchdog found no address overlap with the attacker behind the July 24 Triple-A hack and noted different laundering patterns.

Coinsbuy had not publicly explained how the attacker gained access at the time of BlockWatchdog’s analysis.

Coinsbuy did not immediately respond to a request for comment by Decrypt.

The news comes amid a string of major crypto hacks in recent months. DeFi protocols lost more than $840 million to hacks in the first five months of 2026, according to DeFiLlama.

In July, attackers stole $24 million from Arbitrum-based AFX Trade after exploiting a bridge operated by the decentralized exchange. Earlier that month, decentralized exchange Ostium lost $18 million after an attacker compromised an oracle key.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。