Security Current Affairs ETH

Triple-A Gets Hit for $9.7M in Multi-Chain Wallet Heist

2026-07-27

Singapore-based payments firm Triple-A lost over $9.7 million after attackers breached hot wallets across TRON, Ethereum, Polygon, and Arbitrum, funnelling the lot into 5,227 ETH at a single address. The company confirmed the incident on Monday, July 27, admitting that unauthorized access to its treasury wallets had occurred. But here's the thing that matters: customer funds were untouched.

The attackers struck on July 24–25. They swapped stolen assets on decentralized exchanges, bridged funds across chains into Ethereum, and consolidated everything in one address starting with 0x01F8. It's a pattern we're seeing everywhere lately. Peckshield reported the initial losses at $9.7M, though subsequent tracking pushed estimates closer to $12M.

What's interesting is the timeline. Blockchain analysts flagged the breach on July 24. More than eight hours passed before Triple-A issued any public statement. When they finally did, they were clear: customer funds are safe because they don't custody digital assets on behalf of customers. They maintain separate trust accounts with safeguarding institutions. The financial hit is absorbed by the company's treasury reserves, and all services have been restored.

Specter and PeckShield deserve credit for catching this one early. They spotted the suspicious outflows and raised the alarm before the company went public. Now Triple-A is working with cybersecurity specialists, blockchain forensics firms, and the Singapore Police Force to investigate and recover what they can.

There's a regulatory angle here worth noting. Triple-A holds Major Payment Institution status from Singapore's Monetary Authority and is part of Circle Payments Network as of March 2026. It operates across multiple jurisdictions—American, European, Singaporean territories. That regulatory footprint makes this breach more than just another hack. It's a test of how well these regulated entities actually protect their assets.

The mechanics of the attack suggest something serious happened. Draining $12 million across six chains simultaneously doesn't happen by accident. Either someone nicked a private key, there's a vulnerability in the wallet management layer, or someone on the inside turned. Those are the three scenarios that matter.

This didn't happen in isolation. Triple-A's breach comes on the tail of a brutal week for crypto security. On July 23 alone, three separate attacks drained $35.55 million. AFX Trade, the Verus Ethereum Bridge, and B2 Network all took hits. Industry observers are noticing something: these attacks keep consolidating stolen funds on Ethereum. It's becoming a signature move. The question everyone's asking now is whether we're dealing with the same threat actors across multiple incidents or if copycat attacks have become standard procedure in this ecosystem.

The payments infrastructure underpinning crypto's growth remains a favourite target for attackers. Every breach like this one is a reminder that security is still the bottleneck.

Source & further reading:

Sources