Coinsbuy Loses $8M in Cross-Chain Attack as Stolen Funds Move Through Crypto Swappers

• Coinsbuy suffered a cross-chain attack involving nearly $8M in crypto.
• Most stolen funds were routed through FixedFloat and other swapping services.
• Investigators are tracking frozen and unmoved assets as Coinsbuy probes the attack.

Crypto attackers are becoming increasingly creative in how they move stolen funds.

Coinsbuy has suffered an attack involving nearly $8 million in digital assets across the Tron and Ethereum networks, with investigators tracing a large portion of the stolen funds through crypto-swapping services.

The incident highlights how cross-chain infrastructure can make it harder to follow stolen assets once they leave an exchange’s wallets.

Nearly $8M Drained From Coinsbuy

The attack reportedly began on August 9 with a small test transaction on the Tron network.

The attacker then moved quickly, draining eight Tron wallets containing approximately $6.04 million worth of USDT.

At around the same time, three Ethereum wallets were emptied of roughly $1.89 million in USDT and 77 ETH.

The combined losses put the estimated value of the stolen assets at between $7.9 million and $8.07 million.

Investigators Link the Attacks Across Two Networks

Initially, transactions occurring on separate blockchains can make an attack appear fragmented.

However, blockchain investigators identified connections between the Tron and Ethereum transactions and linked them to the same attacker.

The suspected attacker reportedly used a cross-chain service known as Bridgers to move assets between networks.

This is significant because moving stolen funds across different blockchains can make tracking the money more complicated and potentially create additional opportunities to obscure its origin.

Most of the Funds Passed Through FixedFloat

The movement of the stolen assets did not stop after the initial transfers.

Investigators reported that approximately 79% of the stolen funds—around $6.34 million—passed through FixedFloat using dozens of different addresses.

Some of the stolen ETH was also reportedly sent through ChangeNOW.

The use of multiple addresses and swapping platforms illustrates how attackers can quickly fragment stolen assets and move them through different parts of the crypto ecosystem.

Some Funds Could Still Be Recovered

Not all of the stolen assets have disappeared.

ChangeNOW reportedly froze a six-figure amount linked to the incident, while approximately 282 ETH, worth around $542,000 at the time of reporting, remained unmoved.

These funds could become important if investigators and affected platforms are able to identify and freeze additional assets before they are transferred again.

Coinsbuy Replenishes Affected Wallets

Following the incident, Coinsbuy temporarily suspended deposits and withdrawals while it investigated the attack.

The exchange subsequently replenished the affected wallets to levels close to their pre-attack balances.

That development could indicate that the attacker did not obtain unrestricted access to Coinsbuy’s hot-wallet private keys. However, the exact method used to execute the unauthorized withdrawals remains unclear.

Until Coinsbuy releases a formal incident report, the precise attack vector should therefore be treated as unconfirmed.

What This Means for Crypto Investors

The incident highlights an important risk for crypto users:

Exchanges must protect wallet infrastructure, withdrawal systems and transaction authorization mechanisms against increasingly sophisticated attacks.

For investors, the incident also demonstrates why exchange security and transparency matter.

An exchange that can quickly detect suspicious activity, pause withdrawals and work with blockchain investigators may have a better chance of limiting losses and recovering stolen assets.

The Bigger Picture

Cross-chain technology has made it easier for legitimate users to move assets between different blockchain networks.

But the same flexibility can also be exploited by attackers attempting to move stolen funds quickly across multiple ecosystems.

As cross-chain activity grows, exchanges, blockchain analytics firms and crypto-swapping platforms will face increasing pressure to detect suspicious transactions before stolen assets disappear deeper into the ecosystem.

The Coinsbuy incident is another reminder that crypto security is no longer just about protecting a single wallet or blockchain. It is about securing the entire chain of transactions connecting multiple networks and services.

What to Watch Next

The key questions now are how the attacker gained access, whether more stolen funds can be frozen, and whether Coinsbuy can recover the remaining assets.

Investors should also watch for the exchange’s official incident report, updates from FixedFloat and ChangeNOW, and further movement of the ETH that remains untouched.

For the broader crypto industry, the incident could provide another important case study in how attackers exploit the growing connections between different blockchain networks.