Hackers converted stolen tokens through privacy exchanges (ChangeNOW, FixedFloat, BingX) into Monero within minutes. ChangeNOW and Coinsbuy froze a six-figure portion, but $7M+ successfully became untraceable on the privacy-focused blockchain.
The attack pattern points to either stolen hot-wallet private keys or breached administrative credentials (email, 2FA, VPN). Both require hard remediation: full key rotation, security audits, and staff background reviews across infrastructure.
The processor suspended deposit and withdrawal services immediately, avoiding further exposure. Coinsbuy offered a $100,000 reward for information and coordinated with law enforcement. The incident joins Bybit's $1.5B lawsuit and rising 2026 hack trends.
If you hold funds through a processor or exchange, verify your balances now. Coinsbuy processes B2B flows, not retail deposits, but the lesson applies: custody at scale attracts sophisticated attackers. Self-custody eliminates this risk entirely.
Read More →