Coinsbuy Drained for $7.9M on Ethereum and TRON: The Anatomy of a Hot-Wallet Admin-Key Theft

A crypto payment processor lost nearly $8 million across Ethereum and TRON on August 9, 2026 when attackers drained company-controlled hot wallets — no multi-sig or on-chain delay stood in the way.

Root Cause

On 9 August 2026 at approximately 13:00 UTC, wallets belonging to crypto payment processor Coinsbuy were emptied across both the Ethereum and TRON networks simultaneously. On-chain monitoring firm Specter raised the first public alarm. Security firm GoPlus Security characterised the activity as "consistent with hot wallet private key or administrator privilege theft." No smart-contract vulnerability has been confirmed; the evidence points to an attacker who obtained raw private keys (or equivalent signing credentials) for the company's operational wallets.

// Anti-pattern: custody via plain EOA
// Entire balance drainable with a single stolen private key
contract PaymentProcessor {
    address public hotWallet; // raw EOA — no contract-level controls
    function withdraw(address to, uint256 amount) external {
        require(msg.sender == hotWallet);
        payable(to).transfer(amount); // one call, entire balance gone
    }
}

// Better: Gnosis Safe or equivalent multi-sig
// Requires M-of-N key holders; a single compromised key cannot drain

Attack Steps

Step	Detail
1	Attacker obtains private keys for Coinsbuy's Ethereum and TRON hot wallets (method unconfirmed — phishing, insider, or infrastructure breach are all plausible)
2	~13:00 UTC, Aug 9: wallets on both chains drained in near-simultaneous transactions; Specter flags unusual outflows
3	Stolen assets routed through ChangeNOW, FixedFloat, and BingX to begin laundering
4	Proceeds converted to Monero (XMR) — a privacy coin with no public transaction graph — closing the forensic trail
5	ChangeNOW managed to freeze a six-figure portion before the conversion completed
6	Coinsbuy suspends deposits and withdrawals; services later restored

Impact

~$7.9 million drained (Ethereum + TRON combined; some reports cite ~$8M).
Majority successfully laundered into Monero before investigators could act.
Coinsbuy temporarily suspended deposit and withdrawal services.
Attribution: unconfirmed as of 10 August 2026; root cause post-mortem not yet published.

Lessons for Auditors

EOA hot wallets are a single point of failure. Any protocol or payment processor holding material user funds should replace raw EOA custody with a smart-contract wallet (Gnosis Safe / Safe{Wallet}) requiring M-of-N signers. A single compromised key should unlock at most a small daily allowance, not the entire treasury.
Add on-chain withdrawal limits and time-locks. Contract-level controls — e.g., a SpendingLimitGuard that caps per-24h outflows — create a detection window even when keys are compromised. An attacker who can only drain 1% per day gives defenders time to respond.
Cross-chain key hygiene. When the same key hierarchy controls wallets on multiple chains, a single compromise drains all chains simultaneously. Use chain-specific derivation paths and separate operational wallets per network to limit blast radius.
Monero exit ramp is the new Tornado Cash. Exchanges that accept XMR and privacy coins are now the preferred laundering bridge; protocols should establish relationships with exchanges and on-chain compliance firms before an incident to accelerate freeze requests.
Operational security = audit surface. Traditional smart-contract audits do not examine key management infrastructure. Request key-custody architecture reviews (and ideally red-team exercises) as part of any comprehensive security engagement.