LondonCoinsbuy refilled its drained wallets within 24 hours.
Researchers say the timing suggests attackers reached signing power, not private keys.
Blockchain analysts say the attacker drained $8 million across TRON and Ethereum, laundering 79% through FixedFloat via 50 single-use addresses.
Coinsbuy has not explained how the withdrawal path was accessed, and roughly $542,000 remains unmoved.
Sources: CoinDesk