Coinsbuy Hack Drains $8.07M in Cross-Chain Raid, 79% Funneled via FixedFloat

Crypto exchange Coinsbuy lost $8.07 million on Aug. 9 after an attacker drained wallets on TRON and Ethereum within roughly an hour, according to onchain forensics reviewed by blockchain security researchers. Nearly 79% of the stolen sum, an estimated $6.4 million, was funneled through the instant-swap platform FixedFloat using about 50 single-use addresses, while roughly $542,000 in ETH across five wallets has not moved.

The numbers matter because they show a single, coordinated operation rather than two unrelated breaches. Researchers say the TRON and Ethereum legs of the attack were stitched together through the cross-chain swapper Bridgers, whose Ethereum payout contract sent funds directly into the same swap wallet used on the Ethereum side — the onchain fingerprint that ties both drains to one actor.

How the $8 million moved

The attacker reportedly opened with a test transaction of just 5 USDT before draining eight TRON wallets of 6.04 million USDT in quick succession. On Ethereum, three wallets were emptied simultaneously of 1.89 million USDT and 77 ETH, with the stablecoin swapped into ETH via 1inch through a wallet that had been created the same day — a detail that points to advance preparation rather than an opportunistic grab.

Beyond the FixedFloat routing, exchange ChangeNOW froze a six-figure portion of the stolen assets after being contacted by blockchain investigation firm Specter Investigations. That leaves a meaningful slice of the $8.07 million either frozen or dormant, giving investigators a rare window to trace the remaining flows before they are laundered further.

Wallets refilled, but the entry point is still unknown

Within 24 hours of the attack, Coinsbuy refilled the drained wallets to within 0.05% of their pre-attack balances. Researchers interpret that as a signal the exchange’s private keys were not directly compromised, since the team was able to restore liquidity almost immediately rather than being locked out of its own infrastructure.

That leaves the actual attack vector unresolved. Coinsbuy told reporters the incident has been “contained,” but the exchange has not disclosed how the withdrawal path that let the attacker move over $8 million across two blockchains in under an hour was breached in the first place.

Why it matters

For exchange users, the episode is a reminder that even a rapid balance restoration doesn’t answer the harder question of root cause. Until Coinsbuy identifies and publicly addresses how withdrawal permissions were exploited, depositors have no assurance the same gap won’t be used again.

For the broader market, the case underscores how instant-swap services like FixedFloat remain a preferred laundering rail for stolen crypto, absorbing roughly four-fifths of the take within hours. It also shows the value of cross-chain onchain tracing: linking TRON and Ethereum activity through a shared swapper contract is what allowed investigators to freeze funds and identify the operation as coordinated rather than coincidental.

Read more: BTCPay Lightning Nodes Drained, BTC at $64,968; Emergency Patch to v2.4.2

Sources

• decrypt.co
• coindesk.com