Coinsbuy Hack: Crypto Service Lost $7.9 Million After Wallet Attack

Where the Stolen Assets Went

After the withdrawal, the attacker began splitting the crypto assets and moving them through exchange services. According to asset movement data, several directions were involved:

• FixedFloat: an exchange service through which the stolen assets may have passed.
• ChangeNOW: a platform linked to the movement of funds; later, it helped block part of the amount.
• BingX: another platform mentioned among the services involved.
• Monero: part of the amount was converted to this coin due to private transfers and money laundering risks.

For security teams, such schemes are part of a broad threat spectrum: funds move not through traditional bank infrastructure but via crypto routes, where withdrawal speed is key. In this episode, Bitcoin was not among the main withdrawal networks; the focus was on Ethereum and Tron.

Some Funds Were Stopped

After the attack, Coinsbuy and its partners focused on stopping further asset withdrawals and restoring service operations.

• The Coinsbuy team, together with ChangeNOW, managed to block part of the stolen assets.
• The Coinsbuy payment gateway suspended deposit and withdrawal operations for several hours.
• Later, the service reported that all functions were restored and operating normally.

Why Crypto Platforms Are Often Targets for Attacks

Crypto services attract attackers due to the high liquidity of assets, speed of transfers, and the ability to quickly distribute funds across different networks and exchange routes.

The most typical attack scenarios are as follows:

• Phishing: a user or employee is tricked into revealing access through fake websites, emails, or messages.
• Compromise of private keys: the attacker gains control of the wallet and can withdraw funds.
• Infrastructure vulnerabilities: the attack exploits weak points in servers, key storage systems, or internal processes.
• Smart contract bugs: hackers exploit code bugs to withdraw assets from the protocol.

Crypto bridges connect different blockchains and help transfer assets between networks. If such a mechanism has a vulnerability, an attacker can fake transfer logic or withdraw locked assets through a weak spot in the bridge contract or infrastructure.

How to Reduce the Risk of Losing Funds

• Store large amounts in cold wallets, not on platform hot accounts.
• Enable two-factor authentication for accounts and withdrawal operations.
• Use unique, complex passwords and update them regularly.
• Check website addresses, links in emails, and messages from services.
• Do not keep more funds on crypto platforms than needed for current operations.
• Monitor service security notifications, deposit and withdrawal pauses, and suspicious activity.

Context: THORChain Attack

Earlier, PeckShield and anonymous blockchain researcher ZachXBT reported a hack of the decentralized THORChain protocol, which is used for cross-chain swaps. The damage from that attack was estimated at about $10 million.

{
“@context”: “https://schema.org”,
“@type”: “Article”,
“about”: [
{
“@type”: “Organization”,
“name”: “Coinsbuy”
},
{
“@type”: “Organization”,
“name”: “ChangeNOW”
},
{
“@type”: “Organization”,
“name”: “PeckShield”
},
{
“@type”: “Thing”,
“name”: “hot wallet”
},
{
“@type”: “Thing”,
“name”: “private keys”
},
{
“@type”: “Thing”,
“name”: “digital assets”
},
{
“@type”: “Thing”,
“name”: “blockchain”
},
{
“@type”: “Thing”,
“name”: “theft”
},
{
“@type”: “Thing”,
“name”: “money laundering”
}
]
}