Key Takeaways
- Coinsbuy lost more than $8M across Ethereum and TRON in an August 9, 2026 hack.
- The attacker laundered part of the funds into Monero.
- Details circulating in the media have not been officially confirmed.
- Multi-sig wallets, cold storage, withdrawal limits, and real-time monitoring are the strongest defenses against similar attacks.
On August 9, 2026, wallets linked to crypto payment processor Coinsbuy were drained of more than $8 million across Ethereum and TRON. The attacker started moving the stolen funds into Monero (XMR) shortly after, routing them through several exchange services in an attempt to break the on-chain trail. Here's what's known so far, and how to protect your own funds from similar attacks.
Coinsbuy Hack: What Happened
Coinsbuy is a crypto payment processor. Around 13:00 UTC on August 9, on-chain investigator Specter Analyst flagged unusual outflows from wallets:
Two Ethereum addresses and one TRON address were identified as the main destinations of the stolen funds.
Coinsbuy temporarily suspended deposits and withdrawals as a precaution while it assessed the breach, then restored both services a few hours later.
Investigators say the pattern points to compromised wallet keys or admin-level access on Coinsbuy's side rather than any flaw in the Ethereum or TRON networks themselves. The exact attack vector hasn't been confirmed publicly.
Coinsbuy Hack at a Glance
| Detail | Info |
|---|---|
| Date | August 9, 2026, ~13:00 UTC |
| Chains affected | Ethereum, TRON |
| Amount reportedly stolen | $8M+ |
| Laundering method | Conversion into Monero (XMR) via multiple exchanges |
The story moved fast across crypto Twitter/X as security researchers and outlets picked it up within hours of the drain.
Several media outlets have reported that a substantial amount of funds associated with the incident was stopped while passing through ChangeNOW infrastructure. Our AML team is actively working on the case and cooperating with the relevant parties and authorities.
However, to protect the security and interests of those affected by the hack, we cannot disclose specific amounts, transactions, or other case details. We also cannot confirm or discuss individual cases that may be subject to ongoing law-enforcement investigations until we receive official clearance from the relevant authorities. Stay tuned for the official report.
What we can tell you right now is how to protect your own funds from similar attacks.
How to Protect Your Crypto From Coinbuy-like Attacks
The Coinsbuy incident, though the type of hack is not confirmed yet, is a reminder that wallet security is where most hacks actually happen.
For Businesses and Platforms
- Use multi-signature wallets for hot wallet operations so no single compromised key can drain funds.
- Segment hot and cold storage, keeping only the funds needed for daily operations in hot wallets.
- Rotate and restrict admin access regularly, and log every privileged action.
- Set withdrawal limits and delays that trigger manual review for unusually large transactions.
- Monitor on-chain activity in real time so anomalies are caught in minutes, not hours.
For Individual Users
- Reach out to our support team if you notice anything suspicious. The ChangeNOW live chat is available 24/7, as well as our support specialists at support@changenow.io.
- Never share your private keys or seed phrases with anyone, including support agents.
- Use cold wallets for holdings you don't need to move frequently. Learn how to protect your cold wallet in our previous report: Are cold wallets safe?
- Enable withdrawal whitelists and 2FA wherever a platform supports them.
- Verify addresses carefully before sending funds, especially on unfamiliar platforms.
