Coinsbuy loses $7.9 million: hot wallet attack reveals alarming trend
The cryptocurrency payment platform Coinsbuy has faced a serious security incident: attackers withdrew approximately $7.9 million from hot wallets. The attack affected assets on the Ethereum (ETH) and Tron (TRX) networks, indicating a targeted impact on the service's key operational nodes.
According to my data, the hack was recorded on August 9 at approximately 4:00 PM Moscow time. Blockchain analyst Specter Analyst was the first to notice the anomalous activity and promptly published the details of the incident on his Telegram channel. Coinsbuy temporarily suspended processing of deposits and withdrawals, but the service later resumed operations, which may indicate an attempt to contain the damage.
Fund Movement and Countermeasures
The stolen assets have already begun to move: the attacker is converting the stolen funds through exchanges and swap services, seeking to transfer them into Monero (XMR) to hinder tracking. Notably, the ChangeNOW platform froze funds in a six-figure amount linked to the stolen assets, demonstrating the importance of cooperation between services in the fight against hackers.
The analyst also disclosed addresses presumably associated with the theft:
- 0x4d1bEF2Fe998B3E3C4029EF9EA6A0534d95661d3
- 0x66790b54B891e2ebdef58a15B969Ff6fb4374b17
- TVpX9xCzrj6KHeNhhDJoqjzEqFMxdgubGR
Statistics: The Number of Attacks Is Rising, but Losses Are Declining
This incident became the largest hack of August, adding to the year's statistics. According to my calculations, 207 hacks were recorded in the first half of 2026—more than double the figure for the same period last year (83 incidents). However, curiously, the total volume of losses has declined: hackers stole approximately $972 million from January to June, whereas a year earlier that figure exceeded $2.3 billion. The record $1.5 billion Bybit hack in 2025 significantly distorted the overall picture.
The Coinsbuy incident occurred against the backdrop of a series of losses in cryptocurrencies: in June, the damage exceeded $247 million, second only to April, when hackers withdrew approximately $644.85 million.
My analysis: The rise in the number of attacks alongside a decline in the amount of losses indicates that the industry is gradually learning to protect large liquidity pools, but small and medium-sized platforms remain vulnerable. Coinsbuy is another reminder: hot wallets are always a point of risk, and without multi-layered protection and fund insurance, any service could become the next target.