How much was lost in the CoinSpot hack?

$2.4M Stolen, as publicly reported (November 8, 2023).

CoinSpot Hack: $2.4M Stolen

Q: How was the CoinSpot hack carried out?

Hot Wallet Extraction. Two transactions — 1,262 ETH and 20.99 ETH, ~$2.4M combined — moved from CoinSpot hot wallets to the attacker address below. The pattern is consistent with a private-key compromise rather than a contract exploit.

November 8, 2023 · Ethereum / Bitcoin

stolen

$2.4M

first transaction

1,262 ETH

addresses traced

266

What happened

On November 8, 2023, CoinSpot — one of Australia's largest centralized exchanges — saw roughly $2.4M leave its hot wallets in what security researchers assessed as a private-key compromise. Two transactions, 1,262 ETH and 20.99 ETH, flowed to an attacker-controlled address; on-chain investigator ZachXBT was first to flag the movement and reported that the proceeds were swapped onward into Bitcoin. CoinSpot never officially confirmed a breach. ChainHint's own trace is an Ethereum-side trace, and it ends where the value leaves the observable EVM surface: every endpoint it reaches resolves as unknown, a textbook illustration of the "payment break" that severs a single-chain trail. Which service carried the value off Ethereum is not something this trace establishes — the one node in it that names one rests on a hand-entered label, so this page does not repeat the name.

How the funds moved

Step 1

Hot Wallet Extraction

Two transactions — 1,262 ETH and 20.99 ETH, ~$2.4M combined — moved from CoinSpot hot wallets to the attacker address below. The pattern is consistent with a private-key compromise rather than a contract exploit.

Step 2

Conversion Off Ethereum

The attacker swapped the stolen ETH onward and off Ethereum, hopping chains to break token-level traceability before the Ethereum trail could be followed further. ZachXBT reported Bitcoin as the destination; our Ethereum-side trace reaches the boundary and not across it.

Step 3

Where the Ethereum trail ends

The Ethereum-side trace ends at the swap boundary; every one of ChainHint's endpoints carries the type unknown, because the value left the observable EVM surface. Where the value went on the Bitcoin side is not something this trace answers.

Where the funds went

Read from the transfers in ChainHint's trace, not from press reports

First transfer

Nov 8, 2023

Last transfer traced

Sep 8, 2026

Hops traced

DEX swaps

First hop out of the attacker's address

$2.42METH

$848KWBTC

ChainHint's trace of the CoinSpot hack follows 1,015 transfers across 266 addresses and 6 hops, between Nov 8, 2023 and Sep 8, 2026. The first hop out of the attacker's address moved ETH ($2.42M), WBTC ($848K). 6 of the transfers are DEX swaps.

Visualized attack path

266 addresses · 1,015 transfers · Traced with ChainHint

View Interactive Graph →

Key findings

Attacker Address

0x326d…89b8CoinSpot Exploiter — received both hot-wallet transactions totalling ~$2.4M. Verified on-chain and independently by investigator ZachXBT.

ExploiterKey Compromise

Destination Pattern

Trail ends at the EVM boundaryThe ETH was swapped onward and left Ethereum. Every one of ChainHint's endpoints shows as unknown by design — the trail leaves the chain this trace covers, and whatever happened next is outside this graph.

Payment Break

Aftermath

No official confirmationCoinSpot did not publicly confirm a breach. The conversion off Ethereum severed the single-chain trail, leaving the final destinations outside this trace's visibility.

Investigate your own incident

ChainHint traced the CoinSpot hack in minutes.
Use the same tool for your case.