Coinsbuy was hacked, all 11 wallets were looted, and the attacker was transferring funds...

How did the Coinsbuy attack happen?

Cryptocurrency exchange and payment platform Coinsbuy lost more than US$8 million in a coordinated attack. Its wallets on its wavefield and Ethereum network were looted, and most of the stolen assets were then quickly transferred through exchanges and redemption services. The incident began with a 5 USDT test transaction on August 9. Subsequently, the attacker cleared eight wavefield wallets associated with Coinsbuy in about an hour and stole approximately 6.04 million USDTs. At almost the same time, three Ethereum wallets also lost another 1.89 million USDTs and 77 ETH. These Ethereum assets were transferred through a wallet created on the day of the attack, and some of the funds were redeemed through the decentralized exchange aggregator 1inch. Activities on wavefields and Ethereum initially appeared to be independent. On-chain investigators later connected the two through cross-chain redemption service Bridgers. Funds originating from the wavefield flow through the service, and its Ethereum payment contracts send assets directly to wallets used for redemption on Ethereum. This connection proves that the two wallet robberies were the same operation, rather than unrelated attacks.

How fast can attackers move funds?

Attackers almost immediately began dispersing the stolen cryptocurrency. About 79% of the stolen money is transferred through the instant redemption platform FixedFloat, using approximately 50 one-time addresses. Dispersing funds to new addresses makes tracking more difficult and reduces the time it takes for exchanges and service providers to identify and freeze stolen assets. As attackers continued to redeem and reallocate the stolen money, the rest of the money was also transferred through other encryption services. After contacting blockchain investigation agency Specter Investigations, ChangeNOW froze a six-figure amount of funds. About 282 ETH pieces (valued at approximately $542,000 at the time of investigation) remained at five addresses without further movement. This money-laundering model demonstrates the practical limitations of blockchain transparency. Transactions are still publicly traceable, but attackers can transfer assets to dozens of wallets, platforms, tokens and networks in minutes. Recovering funds often depends on whether investigators can identify the transfer path before the funds reach a service where they can be redeemed or withdrawn.

Investor revelation

The Coinsbuy incident shows that the speed of money laundering after theft is almost as important as the initial breach. Exchanges may only have minutes to track the address and coordinate the freeze, after which the stolen funds are spread across multiple services.

Why is it important for Coinsbuy to replenish your wallet balance?

Coinsbuy restored the affected operating wallet in approximately 24 hours, bringing its balance back to pre-incident levels, within 0.05%. The company said all the affected amounts were covered by its own reserves and customers did not suffer losses. The act of replenishing wallet balances may also provide clues to Coinsbuy's view of events. If the attacker still controls the private key of the emptied wallet and redeposits millions of dollars into the same wallet, it could put these supplementary funds at risk of being stolen again. As a result, the company's relatively quick decision to replenish its wallet balance may indicate that it believed the underlying private key had not been continuously compromised. Investigators have raised the possibility that the attacker may have used other links in the transaction process, although this has not been confirmed. Modern encryption platforms rely on signature infrastructure, automated approval systems, access controls, and software that connects internal systems to blockchain wallets. If an attacker breaks one of these layers, he may be able to authorize transactions without having to obtain each individual private key. This possibility is consistent with the coordinated nature of the attack. Eleven wallets on both networks were looted in a short period of time, making common weaknesses in wallet management or transaction infrastructure an area that investigators may focus on for review.

What issues did this attack reveal about exchange security?

Coinsbuy has not disclosed the technical reasons for the incident. It remains unclear whether the attacker exploited internal credentials, signature infrastructure, automated transaction systems, malware, or other operational level weaknesses. The company said the incident was under control, the platform was operating normally, and the investigation was still ongoing. The attack occurred in a year when encryption security incidents occurred frequently. In the first half of 2026, more than 200 publicly confirmed hacking incidents were recorded, resulting in losses of nearly US$1 billion. Although total losses were lower than the same period in 2025, the number of incidents increased sharply. Coinsbuy's $8 million loss was small compared to the industry's largest security breach, but the coordinated use of two blockchains and rapid money laundering operations in the attack attracted attention. The attacker not only appeared to be ready to raid the wallet, but also planned a route for subsequent dispersion of the stolen money. Paying out customers can mitigate the direct financial impact, but the more critical question is how an attacker can gain the ability to transfer assets from multiple wallets on different networks. The next test for Coinsbuy is to explain the entry point and show what controls have been put in place to prevent the same method from being used again.