Crypto payments firm Triple-A's hot wallet losses reached approximately $11.8 million as new deposits continued being drained, onchain investigator Specter said in a post on X early Sunday. The apparent compromise began Friday at 5:18 p.m. ET when Specter first flagged outflows exceeding $9.3 million, with an additional $1.8 million taken across Bitcoin and TRON networks by Sunday. New deposits were still arriving at affected wallets and being swept 31 hours after the initial large outflows appeared, according to Specter's Sunday update. Triple-A, licensed by the Monetary Authority of Singapore as a major payment institution, confirmed it was investigating the situation and stated that customer funds were not impacted.
Specter Flags Initial $9.3 Million Drain on Friday
Specter first flagged the drain at 5:18 p.m. ET on Friday, putting losses at more than $9.3 million and reporting the attacker had swapped the assets and bridged them to Ethereum. PeckShield, citing Specter, raised the figure to more than $9.7 million about four and a half hours later. Specter said Sunday a further $1.8 million had been taken across the Bitcoin and TRON networks.
Funds Pooled at Single Ethereum Address Across Multiple Networks
The affected networks included Ethereum, TRON, Polygon, Arbitrum, Solana and The Open Network, according to earlier reports from Specter and blockchain security firm PeckShield. Bitcoin had not previously been named among the affected networks. The proceeds were pooled at a single Ethereum address, and the screenshot attached to PeckShield's alert showed the address holding 5,226.67 ETH worth about $9.73 million. It listed eight incoming transfers between 20:35 UTC Friday and 03:03 UTC Saturday, the largest totaling roughly 4,140 ETH.
Triple-A Confirms Investigation with Customer Funds Safe
Triple-A addressed the reports on X on Saturday, stating it was actively investigating the situation and would share a formal update once ready. The company confirmed that customer funds were not impacted. Triple A Technologies Pte. Ltd. is licensed by the Monetary Authority of Singapore as a major payment institution and processes stablecoin payments for merchants that settle in local currency. Its European arm, Paytop SAS, holds payment institution and crypto-asset service provider licenses in France, and the group is registered as a money services business in the U.S. and Canada.
Since Oct. 4, 2024, Singapore's Payment Services Regulations have required licensed digital payment token service providers to safeguard customer assets in trust accounts, while MAS guidance calls for those assets to be held at blockchain addresses separate from the firms' own holdings. Triple-A has not identified what the affected wallets contained, saying only that customer funds were not impacted. Triple-A has not published the promised formal update in its newsroom, where the latest entry remains a July 15 announcement that Dubai's Virtual Assets Regulatory Authority granted the company in-principle approval for broker-dealer services.
Incident Follows $24.15 Million AFX Trade and $7.54 Million Verus Bridge Exploits
The incident follows two other large crypto exploits disclosed this week. AFX Trade, a protocol on Arbitrum, lost about $24.15 million in USDC through its custody bridge in an exploit disclosed Wednesday. The Verus-Ethereum bridge lost roughly $7.54 million the same day, its second breach since May.
FAQ
What happened to Triple-A's hot wallets?
Triple-A's hot wallets suffered an apparent compromise that resulted in approximately $11.8 million in losses as of early Sunday, according to onchain investigator Specter. The drain began Friday at 5:18 p.m. ET with initial losses exceeding $9.3 million, and new deposits continued being swept 31 hours after the first large outflows appeared.
Which blockchain networks were affected in the Triple-A incident?
The affected networks included Ethereum, TRON, Polygon, Arbitrum, Solana, The Open Network, and Bitcoin, according to reports from Specter and blockchain security firm PeckShield. The proceeds were pooled at a single Ethereum address holding 5,226.67 ETH worth about $9.73 million.
Did the Triple-A security incident affect customer funds?
Triple-A confirmed on Saturday that customer funds were not impacted by the incident. The company stated it was actively investigating the situation and would share a formal update once ready, though it has not identified what the affected wallets contained.
