Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC 
ETH 
XMR Coinsbuy's associated wallet was stolen across the chain, resulting in a loss of more than US$7.9 million. The funds were converted into Monero
The wallet associated with cryptocurrency payment service provider Coinsbuy suffered cross-chain theft on Ethereum and the Wave Field chain, resulting in a loss of more than US$7.9 million. The stolen assets are then circulated through multiple exchanges and eventually converted into Monero (XMR).
Chain investigator Specter tracked the suspicious outflow of funds at around 13:00 UTC on August 9. Coinsbuy suspended deposit and withdrawal services after the incident and later resumed it. With the assistance of ChangeNOW, a six-figure amount of some of the stolen funds has been frozen.
The attack method has not been publicly confirmed. Existing evidence suggests that this incident originated from the intrusion of Coinsbuy's wallets, not the destruction of Ethereum or the Wave Field network itself.
Stolen funds are transferred through exchanges and converted into Monero
Stolen assets are transferred from affected wallets to multiple exchange services, and operators begin to convert some of the proceeds into XMR. Platforms such as ChangeNOW, FixedFloat and BingX appear in the subsequent trading path.
Monero's privacy architecture hides transaction amounts, sender addresses and recipient information, making public tracking extremely difficult once funds enter the network. Therefore, after the exchange completes the XMR redemption, the traces of traceability of blockchain will be greatly reduced.
ChangeNOW intervened and froze a six-figure amount of funds before all tracked assets left the platform. Coinsbuy has not disclosed the exact balance recovered, nor has it said how much of the $7.9 million is still traceable.
The company's platform provides merchants, exchanges and other businesses with cryptocurrency payment processing and wallet infrastructure, including multi-chain custody, deposit and automatic withdrawal services.
Cross-chain theft Immediately following the Triple-A theft
Prior to the Coinsbuy theft, Specter tracked a $9.7 million theft related to a Triple-A-associated wallet, which affected the chains such as Wave Field, Ethereum, Polygon and Arbitrum. Stolen funds are consolidated into ETH through bridges, and part of the balance is subsequently transferred through privacy infrastructure.
Both incidents involved the outflow of funds from wallets related to multiple chains of cryptocurrency payment companies, but there is no evidence of a connection between the attackers and no common intrusion method found.
This loss has exacerbated the recent high incidence of cryptocurrency theft cases. In July, 30 major hacking attacks resulted in the theft of $210.3 million, an increase of 177.2% from June.
Coldcard related losses exacerbate security pressures
Wallet security issues continue to attract attention. Previously, losses from Bitcoin theft related to Coldcard had reached US$132 million. Galaxy Research found that at least 15 suspected attackers used seeds generated by vulnerable Coldcard firmware to attack, and thousands of addresses were involved in the massive theft.
Unlike the Coinsbuy case, no seed generation, smart contracts or software vulnerabilities have been found. The interruption of its operations has ended, and deposits and withdrawals have resumed after a temporary suspension.
ChangeNOW's freezing operation was the only publicly disclosed recovery operation, and the total confirmed losses still exceeded $7.9 million.
