Overview
- Blockchain investigators say an attacker drained about $7.9–8.07 million from Coinsbuy wallets on Aug. 9 after a 5 USDT test transfer that preceded rapid withdrawals from TRON and Ethereum addresses.
- On‑chain forensics tied the two chains together through the Bridgers cross‑chain swapper and show roughly 79% of the stolen value flowed into the instant exchange FixedFloat using many single‑use addresses.
- ChangeNOW froze a six‑figure amount and roughly 282 ETH remained unmoved in several addresses, while Coinsbuy returned about $3.93 million to the drained wallets within 24 hours and says no clients suffered losses.
- Coinsbuy has opened a $100,000 identification bounty plus a recovery bonus and says it covered affected balances from its reserves, but the company has not published a technical postmortem or confirmed the attack vector.
- Investigators warn the conversion of some proceeds into Monero and heavy use of single‑use addresses make tracing and legal recovery harder, and the next material updates will be a verified technical report and any exchange‑led asset recoveries.