Crypto payments platform Coinsbuy says it has covered all client losses after wallets tied to the service were allegedly drained on Sunday. Blockchain investigator SpecterAnalyst reported that more than $7.9 million was moved out across Ethereum and TRON, with parts of the proceeds routed through exchanges and into Monero.

According to SpecterAnalyst’s Telegram post, the attacker initially began converting the stolen funds into Monero via exchange activity. The same report claimed ChangeNOW was involved in freezing a six-figure portion of the assets during the incident.

Key takeaways

• Coinsbuy confirmed an Aug. 9 security incident and stated affected client funds were fully covered from its own reserves.
• SpecterAnalyst alleged that attackers moved over $7.9 million across Ethereum and TRON, with additional steps to route value into Monero.
• Coinsbuy temporarily paused deposits and withdrawals, later restoring both services to normal operations.
• The platform offered a $100,000 reward for information leading to the identification of those responsible, with an extra bonus for help recovering the funds.

Alleged multi-chain drain and attempts to obscure proceeds

SpecterAnalyst’s report focused on on-chain activity tied to Coinsbuy-linked wallets. The investigator said the stolen funds were routed through multiple addresses and then moved onward into Monero through exchange interfaces, a strategy commonly associated with attempts to reduce traceability.

In the same Telegram post, SpecterAnalyst identified three addresses linked to the compromised funds—two on Ethereum and one on TRON—suggesting the attacker exploited access across more than one network rather than relying on a single chain or transfer pattern.

The alleged scale is central to why this case matters for the broader payments market: payments platforms typically sit at a crossroads between user custody, exchange-like routing, and business workflows. When that infrastructure is compromised, the incident can quickly ripple from a single compromised wallet into large cross-chain movements.

Coinsbuy response: coverage from reserves and operational restart

Coinsbuy acknowledged the incident in a statement shared with Cointelegraph. The company said unauthorized withdrawals affected several platform wallets, but that all affected client funds have been fully covered from its own reserves—meaning users were not expected to bear direct financial loss.

Coinsbuy also said the platform is back to normal operation, with deposits and withdrawals restored. SpecterAnalyst previously reported that Coinsbuy temporarily paused both deposits and withdrawals following the incident before reinstating service.

While Coinsbuy did not confirm or dispute the reported $7.9 million figure attributed by SpecterAnalyst, it did not provide additional technical details during the early stages of investigation. The company said it is still investigating and plans to disclose technical information only after its review is complete and findings are verified.

Freezing assistance and what remains unclear

SpecterAnalyst claimed that ChangeNOW helped freeze a six-figure portion of the assets during the incident. That point is important for investors and operators because it highlights how quickly counterparties can sometimes mitigate exposure once abnormal flows become apparent. At the same time, the overall timeline, the exact mechanism used by the attacker, and the full extent of assets that were frozen versus successfully moved were not fully substantiated in the publicly available reporting.

Coinsbuy’s statement did not detail the attack method or explain whether compromised keys, misconfigured permissions, or another failure mode was responsible. For readers, the key takeaway is that the public narrative currently rests on investigator tracing of blockchain activity and the platform’s assurance of coverage, rather than on confirmed technical findings.

Given that the platform is delaying technical disclosure until verification, what watchers should monitor next is whether Coinsbuy’s eventual investigation identifies the initial breach vector and whether it leads to changes in internal controls, monitoring, or custody procedures across its networks.

Incentives for information and possible recovery efforts

Beyond covering client funds, Coinsbuy said it offered a $100,000 reward for information that leads to identifying those responsible. The platform also indicated it would provide an additional bonus for help recovering stolen funds.

Rewards of this type can be a practical lever for incident response, especially when stolen assets are dispersed across exchanges and networks. They can also encourage third parties—such as analysts who can link wallets to identities or brokers who may have custody-relevant information—to share actionable details before assets become permanently difficult to trace.

For users of crypto payments infrastructure, the reward plus coverage stance provides some near-term stability, but it does not eliminate the longer-term concern that vulnerabilities in operational security can recur if root causes are not addressed. The most consequential follow-up will be whether Coinsbuy’s later disclosures point to structural weaknesses that can affect other platforms with similar architectures.

As Coinsbuy continues its investigation and refrains from releasing technical details for now, the next signals to watch are: any confirmed update on the attackers’ initial access method, whether additional funds beyond what was reportedly frozen can be recovered, and what operational or custody safeguards the company says it will change after verification.

Wallets linked to crypto payments platform Coinsbuy were reportedly drained of more than $7.9 million across Ethereum and TRON on Sunday.

According to a Telegram post from blockchain investigator SpecterAnalyst, the attacker began moving the stolen funds into Monero through exchanges, while ChangeNOW helped freeze a six-figure portion of the assets.

Coinsbuy temporarily paused deposits and withdrawals following the incident before restoring both services, according to SpecterAnalyst. The investigator identified three addresses linked to the stolen funds, including two Ethereum addresses and one TRON address.

Source: SpecterAnalyst, Telegram

Incorporated in Panama, Coinsbuy is a crypto payments platform that provides businesses with infrastructure to accept, store, send and exchange digital assets.

Related: BTCPay restricts remote Lightning access after attackers steal funds

Coinsbuy covers client losses, offers $100K reward

Coinsbuy confirmed the Aug. 9 security incident in a statement shared with Cointelegraph, saying unauthorized withdrawals affected several platform wallets. The company wrote:

All affected client funds have been fully covered by Coinsbuy from our own reserves, so our users have not experienced any financial losses. The platform is back to operating normally, with all services fully available. 

It is investigating the incident but said it will not disclose technical details until the investigation is complete and its findings have been verified. The company did not confirm or dispute the reported $7.9 million figure.

Coinsbuy also offered a $100,000 reward for information leading to the identification of those responsible, plus an additional bonus for help recovering the stolen funds.

Magazine: Do the Coldcard attacks mean all hardware wallets are now insecure?

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

A federal judge has paused the CFTC’s civil case against a US Army soldier accused of using classified information to earn more than $400,000 from Polymarket contracts tied to Nicolás Maduro’s removal.

CFTC case paused until criminal proceedings conclude

US District Judge Andrew Carter granted prosecutors’ request on Aug. 10 to stay the Commodity Futures Trading Commission’s civil case against Gannon Ken Van Dyke, an active-duty US Army Special Forces master sergeant.

The civil proceeding will remain paused while the Justice Department pursues its criminal case over substantially the same alleged conduct. Prosecutors asked for the stay in July, arguing that allowing both matters to advance could create complications because they involve overlapping evidence, witnesses, and legal questions.

Van Dyke opposed the request and sought to defend both cases at the same time. Carter nevertheless concluded that pausing the civil action pending the criminal case was appropriate.

A stay does not dismiss the CFTC’s claims or decide whether Van Dyke violated commodities law. It temporarily suspends the regulator’s lawsuit while the criminal case, which carries greater potential consequences for the defendant, moves forward.

The CFTC filed its complaint in April. It accused Van Dyke of fraudulently trading event contracts using material nonpublic information obtained through his military role.

The regulator seeks disgorgement, restitution, civil penalties, permanent trading restrictions, and an injunction against further violations of the Commodity Exchange Act.

Soldier allegedly made $409K from Maduro contracts

The Justice Department charged Van Dyke with unlawfully using confidential government information, theft of nonpublic information, commodities fraud, wire fraud, and conducting an unlawful monetary transaction.

Prosecutors allege that Van Dyke participated in planning and executing Operation Absolute Resolve, the US military operation that captured Maduro in January. His role allegedly gave him access to sensitive information about the operation before it became public.

Van Dyke allegedly created a Polymarket account on Dec. 26, 2025, and used a virtual private network with a foreign exit node to access the platform. Court filings say he spent approximately $33,934 on 13 trades between Dec. 27 and Jan. 2.

The positions included “Yes” contracts on whether Maduro would leave office by Jan. 31, whether US forces would enter Venezuela, and whether President Donald Trump would invoke war powers against the country.

According to prosecutors, Van Dyke bought more than 436,000 shares in the Maduro removal market before US forces captured the Venezuelan leader on Jan. 3. Several contracts subsequently resolved in his favor, leaving him with approximately $409,881 in profit.

Authorities also allege that Van Dyke moved the proceeds through a foreign crypto vault, an exchange and a newly opened brokerage account. He later asked Polymarket to delete his account after reports began circulating about suspicious trading on the Maduro contracts.

Van Dyke pleaded not guilty to the charges. crypto.news previously reported that his case represents the first US insider-trading prosecution involving a prediction market.

Defense challenges the CFTC’s event-contract theory

Van Dyke has filed a motion seeking dismissal of the criminal indictment on several grounds. One argument questions whether Polymarket’s binary event contracts can be treated as swaps under the Commodity Exchange Act.

His lawyers contend that the CFTC’s treatment of these contracts was legally ambiguous when the alleged transactions occurred. That challenge could force the court to examine whether existing derivatives laws clearly cover blockchain-based contracts that pay according to political or geopolitical outcomes.

The government relies partly on a provision known as the “Eddie Murphy Rule.” Congress adopted the measure to prohibit federal employees from using nonpublic government information for personal gain in commodity transactions.

The CFTC alleges that Van Dyke acquired information through his government position, owed a duty to keep it confidential and used it to trade swaps for profit. The defense disputes whether the contracts fall within the relevant statutory definition.

The dispute goes beyond Van Dyke’s alleged conduct. A ruling on the contracts’ legal classification could affect how the CFTC approaches future insider-trading cases involving Polymarket, Kalshi and other event-contract platforms.

“Prediction markets are not a haven for using misappropriated confidential or classified information for personal gain,” US Attorney Jay Clayton said when announcing the charges.

Polymarket faces wider insider-trading scrutiny

The case comes as prediction-market operators face growing pressure to identify users trading with confidential information.

Polymarket reportedly referred nearly 100 wallets to authorities after researchers identified suspicious activity across approximately $200 million in first-half 2026 trades. The platform has also said it cooperated with authorities in the Van Dyke investigation.

Congress has opened a separate inquiry into Polymarket and Kalshi, requesting information about surveillance systems, customer identification, and safeguards against trades based on classified material.

The CFTC has pursued similar misconduct on regulated platforms. Former US Representative George Santos recently agreed to return trading gains, pay a penalty, and accept a three-year ban following a CFTC case involving Kalshi contracts.

Van Dyke’s criminal trial could begin in late 2026 or early 2027, depending on the court’s consideration of his dismissal motion and other pretrial disputes. The CFTC’s civil case can resume after the criminal proceeding ends, leaving the regulator’s claims unresolved in the meantime.

The big picture: In an interview on CoinDesk’s Public Keys, Bitwise Head of Research Ryan Rasmussen said investors are underestimating Circle’s opportunity as stablecoins move toward a multi-trillion-dollar market.

• Rasmussen expects the stablecoin market to grow from roughly $300 billion to between $3 trillion and $5 trillion.
• He said Circle is particularly well positioned as U.S. stablecoin regulation takes shape, with its existing market share giving it a head start.
• “I think we’ll look back five years from now and Circle will be not only a stablecoin giant, but a payment giant,” Rasmussen said.

Closer look: Rasmussen’s thesis isn’t just that more stablecoins mean more reserve revenue for Circle — he sees payments infrastructure becoming a major second business.

• Circle is building infrastructure designed to facilitate payments in a stablecoin-driven financial system.
• Rasmussen said that expansion is being “very mispriced by the market,” as investors remain focused on Circle’s reserve-based business.
• He compared Circle’s potential trajectory to global payments giants including Visa and Mastercard.

The competition: Banks, consumer companies and other incumbents are preparing their own stablecoins, but Rasmussen doesn’t see that as a major threat to Circle.

TRON closed its second quarter with a sharp rebound in stablecoin activity, ending the period holding $87.9 billion in circulating USDT—a level that, according to a Messari report, pushed TRON ahead of Ethereum in USDT circulation. The network also handled $2.1 trillion in USDT transfers across the quarter, underscoring how central stablecoin throughput remains to TRON’s growth story.

Messari’s “State of TRON Q2 2026” report attributes much of the expansion to stablecoin market concentration and renewed transfer momentum. It found that USDT made up 98.5% of TRON’s stablecoin market, while the overall stablecoin base grew 4.1% quarter-over-quarter to a record $89.2 billion. Average daily USDT transfer volume also returned to growth, rising 4.3% to $22.8 billion after it had declined in the first quarter.

Key takeaways

• USDT circulation on TRON hit $87.9 billion in Q2, with Messari noting TRON surpassed Ethereum on circulating USDT.
• USDT transfers increased meaningfully, with average daily transfer volume up 4.3% to $22.8 billion.
• Network usage hit new highs: 11.8 million average daily transactions (+8.7%) and 3.6 million active addresses (+11.7%).
• Fees reversed a two-quarter decline, rising 15.9% to $699.4 million as network fees climbed for the first time since an August 2025 governance change.
• DeFi activity weakened, with DeFi TVL down 1.9% to $4.4 billion and DEX volume falling for a fourth straight quarter.

Stablecoin momentum returns, and activity follows

The quarter’s headline numbers point to a clear relationship: higher stablecoin transfer flow translated into stronger on-chain usage. Messari reports that TRON averaged 11.8 million daily transactions during Q2, up 8.7% quarter-over-quarter. Daily active addresses also increased, climbing 11.7% to 3.6 million.

On peak days, usage reached even more visible milestones. The report says TRON processed a record 14.6 million transactions on June 15. For investors and traders tracking TRON’s health, this kind of throughput matters because it often correlates with broader stablecoin utility—especially when USDT dominates the stablecoin mix.

Messari’s breakdown reinforces that dominance. With USDT at 98.5% of TRON’s stablecoin market, the network’s stablecoin growth is effectively synonymous with USDT growth. That can create outsized upside when transfers accelerate, but it also concentrates risk if stablecoin demand shifts across chains.

Network fees improve after an earlier policy shift

Beyond volume, Q2 also marked a change in revenue dynamics. Messari notes that higher activity helped reverse a two-quarter decline in TRON network fees. Fees increased 15.9% to $699.4 million, their first quarterly increase since an August 2025 governance change reduced the price of TRON’s “energy unit,” a key metric that influences transaction costs.

From an economic perspective, this is an important nuance. Lower energy unit prices can reduce per-transaction costs, which may improve user experience but can also compress fee totals—at least until activity ramps enough to offset the unit price effect. Messari’s finding that the fee decline has now been reversed suggests Q2’s throughput was strong enough to compensate for the earlier pricing change.

DeFi fades while fundamentals for stablecoins strengthen

Not all parts of TRON’s ecosystem followed the same direction. Messari reports that DeFi TVL fell 1.9% to $4.4 billion. The report also shows that average daily DEX volume dropped 21.7% to $49.3 million, continuing a trend of contraction: it was the fourth consecutive quarterly decline.

For market participants, this divergence between stablecoin rails and DeFi activity is worth monitoring. Stablecoins can remain highly active even when trading and on-chain lending demand soften, particularly if users primarily use the chain for payments or settlement rather than DeFi strategies.

TRON’s token supply dynamics also remained a mixed signal. Despite the higher activity levels, the report states that TRX supply stayed inflationary. Circulating supply increased by 87 million tokens during the quarter, with issuance continuing to outpace burns. That means network usage growth in Q2 did not translate into immediate deflationary pressure on supply.

Institutional access expands across trading, tokenization, and staking

Alongside the on-chain activity metrics, Messari highlights a separate thread: growing institutional access to TRON products during Q2. Securitize reportedly launched Hamilton Lane’s tokenized Senior Credit Opportunities Fund on TRON, described as the network’s first TRON-issued asset. The fund began with about $4.3 million under management.

Grayscale also expanded the conversation around institutional custody and exposure by adding TRX to its list of assets under consideration. Separately, a proposed staked TRX exchange-traded product from Canary Capital remained in registration, according to the report.

Broader market access reflected similar momentum. Bitnomial launched spot TRX trading in the United States, OKX Europe introduced MiFID-regulated TRX expiry perpetuals, and Binance.US restored trading in the token during the quarter.

The push for institutional infrastructure did not stop after Q2. Earlier coverage noted that Anchorage Digital added native TRX staking and custody for TRC-20 assets in July, enabling institutional clients to stake TRX directly from its custody platform.

Taken together, these developments suggest TRON’s narrative is broadening beyond consumer usage and stablecoin transfers toward more regulated, institutional-friendly access paths. For investors, that can matter because improved access often reduces friction—both operational and regulatory—when firms decide how to allocate capital across crypto assets.

Looking ahead, readers should watch whether TRON’s stablecoin-driven strength can pull more DeFi liquidity back in, given that DEX volumes and DeFi TVL fell for multiple quarters. At the same time, the sustainability of higher fees after the earlier energy unit change will likely be tested by the next round of network usage—especially on peak days like the June 15 transaction record.

Crypto industry leaders are voicing frustration after the U.S. Senate failed to advance the CLARITY Act before its August recess, leaving the market structure bill facing a crucial procedural vote weeks before the 2026 midterm elections.

CLARITY Act faces a Sept. 15 procedural vote

Senate Majority Leader John Thune filed cloture on the motion to proceed to the Digital Asset Market Clarity Act shortly before the Senate began its month-long recess, according to the Senate Daily Press.

The filing positions the legislation for an initial procedural test after senators return to Washington on Sept. 14. The cloture motion is scheduled to ripen on Sept. 15, according to previous crypto.news coverage.

The vote would determine whether the Senate begins formally considering the bill. It would not amount to final passage.

CLARITY would still need to move through debate and possible amendments before receiving a separate approval vote. Any Senate-approved version that differs from the measure passed by the House would also need to return to the lower chamber before reaching President Donald Trump’s desk.

The legislation needs at least 60 votes to clear the Senate’s cloture threshold. Republicans cannot reach that number without Democratic support, making the remaining bipartisan negotiations central to its prospects.

The House approved the CLARITY Act by a 294–134 vote on July 17, 2025, with 78 Democrats supporting the legislation. The Senate Banking Committee advanced its portion of the legislation by a 15–9 vote in May 2026, with Democratic Sens. Ruben Gallego and Angela Alsobrooks joining Republicans.

Crypto leaders criticize the Senate delay

Industry executives and advocates reacted negatively after lawmakers left Washington without holding a procedural vote.

“You can imagine how frustrated I am,” Sen. Cynthia Lummis said after the chamber failed to schedule the legislation for consideration before the recess.

Lummis added that she would continue working with other senators and described the effort as “far from over.” She had previously pushed for a CLARITY Act vote before the August recess, saying negotiators had spent months working through the bill’s CFTC provisions and other disputes.

Advertisement

Coinbase CEO Brian Armstrong also called the delay disappointing but argued that broader crypto adoption would continue regardless of Congress’ schedule.

Armstrong pointed to stablecoin adoption, tokenization, and expanding digital asset markets as sources of continued momentum. Coinbase Chief Policy Officer Faryar Shirzad similarly said September would offer lawmakers another opportunity to “finish the job.”

As crypto.news previously reported, the delay has not produced an immediate decline in Coinbase shares. COIN closed Friday at $153.60, gaining about 5.7% during the session.

BitMine Chair Tom Lee offered a similar market assessment in the company’s weekly report. Lee said investors appeared more focused on softer inflation and employment data than on the immediate consequences of CLARITY failing to advance before the recess.

Advertisement

Ethics and stablecoin rewards divide senators

The September timetable gives lawmakers more time to negotiate but also pushes the vote closer to the Nov. 3 midterm elections. The Senate will have roughly seven weeks between its return and Election Day, narrowing the available floor time for a complex bill.

Democratic demands for stronger ethics restrictions remain one of the main obstacles. Several lawmakers want the bill to address crypto investments and business interests held by senior federal officials and their families.

Those concerns have centered on Trump’s association with World Liberty Financial and the Official Trump memecoin launched shortly before he returned to office. Sen. Elizabeth Warren supports creating a federal crypto framework but has rejected the current CLARITY Act over corruption, consumer protection, national security, and financial stability concerns.

Banking groups are pressing senators from another direction. They argue that the legislation could still allow crypto companies to provide stablecoin rewards under certain conditions, potentially drawing deposits away from community banks.

Advertisement

The current framework distinguishes between interest paid simply for holding a stablecoin and rewards connected to activities such as trading, payments, or loyalty programs. That distinction has placed companies such as Coinbase at the center of the dispute.

Banking associations have urged the Senate to close what they describe as stablecoin-yield loopholes. Crypto advocates counter that the legislation already prevents stablecoin issuers from paying deposit-like interest and that broader restrictions would protect banks from competition.

Prediction markets remain split on passage

Prediction markets show traders expect the Senate to vote on CLARITY in September, but they remain doubtful that the legislation will become law before the end of 2026.

A Kalshi contract with approximately $1.23 million in trading volume placed the probability of a Senate vote before Oct. 1 at 88%. That closely aligns with the Sept. 15 procedural schedule created by Thune’s filing.

Advertisement

However, a separate Polymarket contract assigned only a 25% probability that CLARITY would be signed into law during 2026. More than $5.79 million had been traded on that market.

The difference reflects the additional steps required after the first Senate vote. Lawmakers must clear the 60-vote threshold, settle disagreements over ethics and stablecoin rewards, approve a final Senate text, and reconcile it with the House version.

Longer-term contracts have increasingly shifted expectations into 2027. Kalshi traders recently placed the probability of the legislation taking effect before July 1, 2027, at 41%, while assigning higher odds to passage under later deadlines, according to crypto.news reporting.

The Sept. 15 vote will provide the next concrete test. Clearing cloture would allow senators to begin considering the bill, but its final passage would still depend on whether negotiators can convert procedural support into a durable bipartisan agreement.

Advertisement