Coinsbuy exploit analysis

On 9 August 2026, the Coinsbuy crypto platform was exploited for around $8 million across the Ethereum and Tron blockchains. The attacker stole funds from eight wallets belonging to the exchange. Coinsbuy later replenished the wallets, suggesting the attack vector did not involve compromising the wallet keys themselves but rather a flaw elsewhere in the platform. Coinsbuy said the vulnerability has been addressed and offered a $100,000 bounty for the return of the funds.

The mechanism was not disclosed in detail. The fact that the wallets were topped up by the company, rather than the attacker voluntarily returning them, is a strong signal that the wallet signing keys remained in Coinsbuy's control throughout. The attacker was able to direct the platform to send the funds out, not to compromise the wallet infrastructure directly. This is consistent with a business-logic flaw: an oracle manipulation, an authorisation bypass on withdrawal paths, or a bug in the platform's withdrawal-handling code. The eight-wallet scope is consistent with a bug in the per-user or per-account withdrawal path that could be triggered repeatedly.

The figure is consistent across sources. The web3isgoinggreat account put the loss at "around $8 million". Decrypt reported the loss at "$8 million". Crypto Briefing reported "$8 million" drained. The Defiant reported "$7.9 million" with a same-day strike, and a separate Crypto Briefing account described the attacker laundering proceeds through Monero. The variation is in the order of a few hundred thousand dollars and likely reflects valuation timing of mixed assets at the moment of the theft.

The response was cooperative and standard. Coinsbuy replenished the affected wallets, made a public disclosure, said the vulnerability has been addressed, and offered a $100,000 bounty for the return of funds. The attacker has not been identified in the reviewed reporting. The exchange continues to operate.

Compared with the other 2026 exchange-style drains in the corpus, Coinsbuy sits with the Triple-A treasury loss of around $11.8 million and the Bitget centralised-exchange loss of $387.5 million. The Coinsbuy case is interesting because the funds were recovered by the exchange itself, not by the attacker returning them or by law enforcement intervention. The hot-wallet-replenishment pattern is not unique to Coinsbuy in the corpus but is uncommon. The cross-blockchain Ethereum-Tron vector echoes the Triple-A case, which also used both Bitcoin and Tron for the drain.