Crypto exchange Coinsbuy loses $8 million in coordinated two-blockchain attack

Coinsbuy's Rapid Response

Coinsbuy experienced a significant security breach on August 9, resulting in the loss of over $8 million across two distinct blockchain networks. Despite the substantial financial impact, the exchange demonstrated a notable level of operational resilience by refilling the drained wallets within 24 hours of the attack. This swift action suggests that the exchange's private keys were likely not compromised, indicating the breach might have originated from a vulnerability in the withdrawal process or a similar operational flaw rather than a direct compromise of core asset custody.

The rapid replenishment of funds is crucial for maintaining user confidence and preventing a potential bank run scenario, which often follows major hacks in the crypto space. However, the exchange has yet to issue a public statement or provide a detailed explanation of the attack vector. This lack of transparency, while perhaps strategic in the immediate aftermath, leaves users and the broader community without critical information regarding the nature of the vulnerability and the steps being taken to prevent future incidents.

TRON and Ethereum Coordination

The attack was particularly sophisticated due to its coordinated nature across both the TRON and Ethereum blockchains. The attacker initially drained 6.04 million USDT from eight TRON wallets, followed by 1.89 million USDT and 77 ETH from three Ethereum wallets simultaneously. This dual-chain operation was linked by blockchain researchers through the use of a cross-chain swapper named Bridgers, whose Ethereum payout contract directed funds directly into the Ethereum swap wallet, confirming a single actor behind the seemingly separate incidents.

This cross-chain coordination highlights an evolving threat landscape where attackers leverage the interoperability of different blockchain networks to execute complex heists. The ability to move funds seamlessly between chains complicates forensic analysis and asset recovery efforts, making it harder for exchanges and security firms to trace and freeze stolen assets. The use of 1inch for swapping ETH further demonstrates the attacker's intent to quickly obfuscate the trail of the stolen funds.

FixedFloat and Fund Movement

A significant portion of the stolen funds, approximately 79%, was routed through the instant exchange FixedFloat. The attacker utilized around 50 single-use addresses to facilitate these transactions, a common tactic to obscure the ultimate destination of the assets and make tracing more challenging. Instant exchanges, while offering convenience, can sometimes be exploited by malicious actors due to their rapid processing times and often less stringent KYC (Know Your Customer) requirements compared to centralized exchanges.

While FixedFloat was a primary conduit, other entities like ChangeNOW played a role in mitigation, freezing a six-figure sum after being alerted by Specter Investigations. This demonstrates the importance of collaboration between security firms and various crypto service providers in responding to such incidents. Despite these efforts, a substantial amount, around 282 ETH (approximately $542,000), remains unmoved across five addresses, offering a potential avenue for future recovery if the attacker fails to move them.