Coinsbuy Loses $8 Million in Cross-Chain Attack on TRON and Ethereum

Researchers traced the theft through cross-chain routes involving Bridgers and swap services like FixedFloat and ChangeNOW. Coinsbuy quickly refilled the wallets, but the attack vector is still unknown.

Key Takeaways

• Coinsbuy lost more than $8 million on August 9 in a coordinated attack across TRON and Ethereum.
• On TRON, eight wallets were drained for 6.04 million USDT; on Ethereum, 1.89 million USDT and 77 ETH disappeared from three wallets.
• Coinsbuy refilled the wallets almost completely within 24 hours, while the attack vector has still not been identified.

Crypto exchange Coinsbuy was hit on August 9 in a coordinated attack that drained more than $8 million (€6.9 million) across TRON and Ethereum. Onchain data reviewed by blockchain security researchers shows the attacker began with a 5 USDT transfer before quickly pulling a much larger amount of funds out.

Attack Across Two Networks

On TRON, eight wallets were emptied over the course of about an hour, with a total of 6.04 million USDT taken. At the same time, three Ethereum wallets were drained for 1.89 million USDT and 77 ETH. The ETH was then swapped through 1inch from a wallet created the same day, which made the trail even more difficult for researchers to follow.

The onchain path ties the two networks together through cross-chain swapper Bridgers. Its Ethereum payout contract sent the funds directly to the Ethereum swap wallet, turning what initially looked like separate actions into a single incident. Cross-chain routes like this have come under heavier pressure in 2026, and in multiple cases, attackers have already stolen hundreds of millions of dollars in crypto, underscoring how exposed this infrastructure can be. Earlier attacks on payment and bridge systems also showed how quickly funds can jump across chains, including Triple-A.

Fund Flows and Response

Researchers said roughly 79 percent of the stolen funds were routed through FixedFloat, spread across about 50 one-time addresses. ChangeNOW also froze a six-figure amount after Specter Investigations reached out. Around 282 ETH, worth about $542,000 (€469,900), remains parked across five addresses.

Coinsbuy replenished the drained wallets within 24 hours, bringing them back to within 0.05 percent of their pre-attack balances. The researchers said that points away from a private key compromise. Even so, the attack vector has not been identified, and Coinsbuy has not commented publicly.

A Signal for the Industry

For European crypto readers, the case is a reminder of how fast an attack can move across chains, wallets, and exchange services. With stablecoin flows and cross-chain infrastructure in particular, a small initial transfer can snowball into a major loss while the source of the breach stays hidden for a long time. That makes incidents like this relevant not just for users, but also for platforms that depend on fast transfers between chains.