Coinsbuy loses $7.9 million in hot wallet attack: incident details
The Coinsbuy platform suffered serious losses of $7.9 million due to a hack of cryptocurrency wallets. The incident affected assets on the Ethereum (ETH) and Tron (TRX) networks, indicating a targeted attack on the service's key payment infrastructures.
The first to raise the alarm was analyst Specter Analyst, who promptly recorded signs of unauthorized access in his Telegram channel. According to his data, the attack occurred around 4:00 PM Moscow time on August 9. In response to the incident, Coinsbuy temporarily suspended processing of deposits and withdrawals, but later resumed operations, suggesting an attempt to minimize panic among users.
The attacker has already begun laundering the stolen funds: assets are being moved through exchanges and converted into Monero (XMR), which significantly complicates their tracking. Notably, the ChangeNOW platform froze a six-figure sum linked to the stolen funds, which could become a key step in the investigation.
Among the addresses involved in the case, analysts highlight:
- 0x4d1bEF2Fe998B3E3C4029EF9EA6A0534d95661d3
- 0x66790b54B891e2ebdef58a15B969Ff6fb4374b17
- TVpX9xCzrj6KHeNhhDJoqjzEqFMxdgubGR
This hack became the largest in August, but it fits into an alarming trend. According to DefiLlama, four security incidents in the crypto industry have already been recorded this month. At the same time, overall statistics show paradoxical dynamics: the number of attacks is growing, while losses are declining. TRM Labs counted 207 hacks in the first half of 2026 — twice as many as the 83 incidents during the same period last year.
Nevertheless, the total damage for January–June 2026 amounted to about $972 million, compared to $2.3 billion a year earlier. This is largely explained by the fact that the 2025 statistics were significantly inflated by the $1.5 billion Bybit hack. June losses of $247 million are second only to April figures, when hackers stole approximately $644.85 million.
My view on the situation
The increase in the number of attacks amid their declining "effectiveness" points to two key trends: first, attackers are becoming less selective, targeting even small platforms, and second, the industry is gradually implementing more reliable protection and response mechanisms. However, the Coinsbuy incident is a reminder that hot wallets remain the Achilles' heel of many services. I recommend platforms review their fund storage protocols and more actively use multi-signature schemes and cold storage.