Coinsbuy Loses $7.9M in Cross-Chain Exploit Spanning TRON and Ethereum

Coinsbuy, a cryptocurrency payment platform, suffered an exploit that resulted in $7.9 million being drained from wallets across TRON and Ethereum. Following the attack, the exploiter moved funds from Coinsbuy-linked addresses into another TRON wallet, which then consolidated the assets before transferring larger amounts to other destinations. The attacker later routed portions through ChangeNOW, FixedFloat, and BingX, expanding the transaction trail across multiple services and complicating recovery efforts.

Activity across both Ethereum and TRON broadens the scope of the incident beyond one blockchain. Investigators must track subsequent transfers to determine where remaining funds move and whether exchanges or other services can identify and restrict the stolen assets.

The cause of the breach remains unconfirmed, though the transfer infrastructure showed operational weaknesses beforehand. On 10 July, Coinsbuy fixed a system issue that confirmed transportation transfers without verifying deposits received on its nodes. This mismatch overstated locked balances and produced false insufficient-funds errors. The update now triggers an incident whenever collected amounts differ from received deposits. While this earlier flaw does not establish the exploit's entry point, it reveals complexity within Coinsbuy's transfer and consolidation processes.

Investigators must determine whether attackers compromised private keys, administrative privileges, or another operational layer controlling wallet movements. Containment is now the critical test: stable wallet balances and no new attacker-linked addresses would indicate Coinsbuy has restricted further movement, while new collector wallets or coordinated transfers would show continued unauthorised access to its withdrawal infrastructure.