Coinsbuy $8M Hack: Tracing Stolen Funds Across Ethereum and Tron Networks

Woofun AI reports that a coordinated theft of $8.07 million from Coinsbuy occurred on August 9, 2026, exploiting infrastructure across Ethereum and Tron networks, with BlockWatchdog leading the forensic trace. The incident highlights how attackers leverage cross-chain bridges to obscure asset origins while exchanges attempt to contain the breach.

The attack execution began with a 5 USDT test transaction on Tron, serving as a probe before the main extraction. Subsequently, more than $6.34 million was drained from eight Coinsbuy wallets on the Tron network. Simultaneously on Ethereum, hackers siphoned $1.89 million in USDT and 77 ETH from three distinct addresses, demonstrating a multi-chain operational capability.

Fund laundering efforts relied heavily on cross-chain services to fragment the stolen capital. BlockWatchdog linked the initial movements through Bridgers, after which approximately 79% of the total stolen value, totaling $6.34 million, flowed through FixedFloat.

Additionally, 150 ETH was routed via ChangeNOW, while 282.2 ETH, valued at roughly $542,000 at the time, remained distributed across five addresses.

Per Woofun AI, the forensic analysis of wallet replenishments revealed critical insights into the vulnerability type. Coinsbuy restored approximately $3.93 million to the same 10 addresses, with seven deposits matching the original stolen amounts within a 0.05% margin. This precision suggests the breach stemmed from a weakness in the withdrawal process rather than a direct private-key compromise.

This incident occurs against a backdrop of rising security threats, with DeFiLlama data showing DeFi protocols lost over $840 million in the first five months of 2026. Attacks frequently target bridges, oracle infrastructure, and exchange systems, underscoring the persistent risks in decentralized finance. The transparency of Ethereum and Tron enabled investigators to track these flows, offering a rare glimpse into the mechanics of modern crypto heists.