A significant security incident has struck Coinsbuy, a B2B cryptocurrency payment processing platform serving enterprises, merchants, and exchanges. On-chain investigators reported that wallets linked to the service were drained of approximately $7.9 million in assets spanning the Ethereum and TRON networks.
The activity was first flagged around 13:00 UTC on August 9, 2026.
Monitoring by Specter Analyst and subsequent alerts from PeckShield indicated that funds moved out of Coinsbuy-associated addresses across both chains in what appears to have been a coordinated operation.
Analysts have pointed to possible compromise of hot-wallet private keys or elevated administrative privileges as the most likely explanation, given the simultaneous impact on two separate blockchains.
Attacker-controlled addresses identified in the forensics include two Ethereum wallets.
After the initial outflow, the perpetrator moved quickly to obscure the trail.
Portions of the stolen assets were routed through centralized platforms such as ChangeNOW, FixedFloat, and BingX before conversion into Monero (XMR), the privacy-focused cryptocurrency known for its resistance to blockchain tracing.
In a limited recovery effort, ChangeNOW assisted in freezing a six-figure sum connected to the incident.
Coinsbuy responded by temporarily suspending deposits and withdrawals as a precautionary step.
Services were later restored once the immediate risk was assessed.
