A Crypto Exchange Lost 8 Million in One Hour Across Two Blockchains — and Refilled Every Wallet Within a Day

A crypto exchange called Coinsbuy lost more than 8 million in under an hour when an attacker pulled off a coordinated heist across two separate blockchains — and the strangest part is that the exchange refilled the drained wallets within a day, suggesting a deeper vulnerability than a simple key compromise.

By Jennifer Kim | August 10, 2026

The Hook: Two Blockchains, One Attack, Eight Million Gone in an Hour

On August 9, a crypto exchange called Coinsbuy was hit by an attack that drained more than 8 million from user wallets across two different blockchains simultaneously. According to onchain analysis by blockchain security researchers BlockWatchdog, the attacker moved 6.04 million USDT from eight TRON wallets and 1.89 million USDT plus 77 ETH from three Ethereum wallets — all in roughly one hour. The total loss came to 8.07 million. But what makes this attack unusual is not just the speed or the cross-chain coordination. It is how Coinsbuy responded.

Within 24 hours of the attack, Coinsbuy had refilled every drained wallet to within 0.05% of its pre-attack balance. That means no customer lost money — the company covered everything from its own reserves. While that sounds reassuring, security researchers say this behavior suggests something troubling: the exchange likely does not believe its private keys were stolen. If someone has your private keys, refilling the wallet just gives the attacker a second chance to drain it again. The fact that Coinsbuy refilled the wallets suggests the vulnerability lies elsewhere — perhaps in the exchange’s withdrawal system or internal access controls.

On-Chain Evidence: How the Attack Unfolded

The forensic trail, pieced together by blockchain investigators and reported by CoinDesk, reveals a carefully planned operation:

• The starting point: A single 5 USDT test transaction, the kind of probe an attacker uses to confirm a withdrawal path works before going for the real money
• The TRON drain: Eight wallets emptied of 6.04 million USDT in about an hour
• The Ethereum drain: Three wallets emptied simultaneously of 1.89 million USDT and 77 ETH, with the ETH swapped through 1inch via a wallet created the same day
• The cross-chain link: Both operations were connected through a service called Bridgers, whose Ethereum payout contract sent funds directly to the Ethereum swap wallet — proving it was one attacker, not two separate incidents
• The laundering: Roughly 79% of stolen funds moved through instant exchange FixedFloat using about 50 single-use addresses. ChangeNOW froze a six-figure sum after being contacted by Specter Investigations
• What remains: Around 282 ETH, roughly 542,000, sitting in five addresses — untouched so far

The use of single-use addresses across FixedFloat is a classic laundering technique. Each new address makes it harder for investigators to trace the full flow of funds. The fact that ChangeNOW — a competing instant exchange — acted quickly to freeze funds shows that cooperation between exchanges is improving, even if most of the money likely made it through.

The Core Conflict: Customer Protection vs. Transparency

Coinsbuy deserves credit for making every affected customer whole within 24 hours. The company told CoinDesk that “all affected amounts have been covered in full by the company from its own reserves” and that “no client has borne any loss.” The platform is reportedly operating normally, and an investigation is underway. For customers, the immediate crisis is over — their balances are restored.

But the broader crypto community has a right to ask: what exactly was compromised? Coinsbuy has not explained how the attacker accessed the withdrawal path. Was it an insider threat? A compromised API key? A flaw in the exchange’s hot wallet configuration? The company says it “cannot disclose further technical details at this stage,” which is understandable during an active investigation, but also means the rest of the industry cannot learn from this incident to prevent similar attacks.

The 8.07 million stolen from Coinsbuy adds to what has been a brutal year for crypto security. According to CoinDesk’s own reporting, roughly 972 million had already been stolen across the sector through late July 2026. Coinsbuy’s loss pushes that figure past 980 million, with four months still remaining in the year. The industry is on pace to exceed 2024’s total losses.

Market Implications: What Coinsbuy’s Hack Means for Altcoin Users

For anyone who holds altcoins or stablecoins on an exchange, this incident offers several important lessons:

• Not your keys, not your coins still applies. Even when an exchange makes you whole, the fact that 8 million can disappear in an hour is a reminder that centralized exchanges are single points of failure. Moving funds to a personal wallet when you are not actively trading reduces your exposure.
• Cross-chain attacks are a growing threat. This attacker hit TRON and Ethereum simultaneously, using a cross-chain bridge to connect the operations. As crypto becomes more interconnected across chains, attack surfaces expand. Security is only as strong as the weakest link between networks.
• The stablecoin angle matters. Nearly all of the stolen funds were in USDT, the dollar-pegged stablecoin. Because stablecoins are designed to hold value steadily, they are attractive targets — worth stealing regardless of market volatility. If you hold large USDT balances on any exchange, consider whether you need that much liquidity on a trading platform.
• Instant exchanges are the first line of defense — and the weakest. FixedFloat was used to launder most of the funds, while ChangeNOW acted to freeze some. These instant swap services sit at the intersection of legitimate use and criminal laundering, and how they respond to incidents like this matters for the whole ecosystem.

The Verdict: A Wake-Up Call Wrapped in a Quick Resolution

Coinsbuy handled the immediate fallout of this attack about as well as any exchange could — every customer was made whole within a day, and the platform continued operating normally. That is more than many hacked exchanges have managed. But the speed of the recovery should not obscure the seriousness of the underlying vulnerability. An attacker moved more than 8 million across two blockchains in under an hour, and the exchange still cannot say exactly how the withdrawal path was compromised.

For everyday crypto users, the practical takeaway is simple: keep only what you need for active trading on exchanges. The rest belongs in a wallet you control. Coinsbuy’s customers were lucky this time — the company had the reserves to cover the losses. The next exchange might not be so fortunate. In a year where nearly a billion dollars has already been stolen from crypto protocols, diligence is not paranoia. It is basic financial hygiene.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.