The coordinated attack happened across the TRON and Ethereum blockchains on Sunday (Aug. 9), CoinDesk reported, citing on-chain data reviewed by blockchain security researchers.
According to the report, the attacker began with a 5 USDT transaction before siphoning 6.04 million of the dollar-pegged stablecoin from eight TRON wallets in the space of an hour. On Ethereum, three wallets were simultaneously emptied of 1.89 million USDT and 77 ETH.
The CoinDesk report added that on-chain records show that the two chains were connected through cross-chain swapper Bridgers, linking what appeared to be individual operations into a single incident.
Coinsbuy refilled the drained wallets to within 0.05% of their pre-attack balances within 24 hours, the report said. Researchers say this suggests the company does not think private keys have been compromised.
The company told CoinDesk that the breaches have been “contained” and that “all affected amounts have been covered in full by the company from its own reserves.”
“No client has borne any loss. The platform is stable and operating normally. Investigation is underway, and we cannot disclose further technical details at this stage,” Coinsbuy added.
As CoinDesk notes, this incident is the latest in a series of crypto thefts, with the sector seeing around $972 million stolen in the first seven months of the year.
In the past few weeks, blockchain network Wemix announced that an attacker had compromised ownership of its WEMIX$ stablecoin, while cryptocurrency wallet SecondFi said it would begin winding down in the wake of a breach in which attackers stole $2.4 million.
Another larger attack at the beginning of the month allowed criminals to steal well over $100 million by exploiting a vulnerability affecting older versions of firmware used by Coldcard, a popular bitcoin hardware wallet made by Coinkite.
“The vulnerability weakened the randomness used to create some wallets’ recovery phrases, making the private keys derived from them potentially discoverable,” PYMNTS wrote last week.
“The incident did not break bitcoin’s encryption or reverse transactions on its blockchain. It wasn’t a wrench attack where attackers stole a physical device, tricked its owner into revealing a password or installed malware on an internet-connected compute,” that report added. “Instead, the failure occurred at the point of a supposedly secure device.”
