Crypto exchange Coinsbuy lost $8 million in a coordinated attack that hit two blockchains at once. The funds were drained from TRON and Ethereum, and onchain forensics point to a single actor behind the whole operation. Most of the stolen money was pushed through FixedFloat, a cross-chain swap service, though the exact entry point remains unclear.
The two-chain drain
The attack wasn't a simple one-off exploit. It was coordinated across TRON and Ethereum, which suggests the attacker had a plan that spanned both networks. That kind of multi-chain coordination is harder to pull off than a single-chain heist, and it complicates the cleanup for exchanges and tracing firms alike.
Coinsbuy hasn't said how the attacker got in. The vector is still unknown, which leaves a lot of open questions for a platform that just lost eight figures.
Where the money went
Most of the stolen funds were routed through FixedFloat. That's a notable detail because FixedFloat is a no-KYC swap service, often used to move crypto quickly and obscure the trail. It doesn't mean FixedFloat did anything wrong, but it does make recovery harder.
Onchain forensics have tied the entire $8 million drain to a single actor. That's a rare level of clarity in these cases, even if it doesn't immediately lead to an arrest or a freeze.
What's still unknown
The big gap is the attack vector. No one has said whether it was a compromised key, a smart contract bug, or something else entirely. Until that's pinned down, other exchanges running similar infrastructure might be at risk.
Coinsbuy hasn't announced a recovery plan or a timeline for updates. The next concrete step will likely be a post-mortem from the exchange or a law enforcement referral, but nothing has been confirmed as of this writing.
