Triple-A hot wallet losses climb to $11.8 million as new deposits keep being swept: report

Losses from an apparent compromise of crypto payments firm Triple-A's hot wallets have grown to roughly $11.8 million, onchain investigator Specter said in a post on X early Sunday.

Specter first flagged the drain at 5:18 p.m. ET on Friday, putting losses at more than $9.3 million and saying the attacker had swapped the assets and bridged them to Ethereum. PeckShield, citing Specter, raised the figure to more than $9.7 million about four and a half hours later.

Specter said Sunday a further $1.8 million had been taken across the Bitcoin and TRON networks, and that new deposits were still arriving at the affected wallets and being drained 31 hours after the first large outflows appeared.

Bitcoin had not previously been named among the affected networks. Earlier reports from Specter and blockchain security firm PeckShield covered Ethereum, TRON, Polygon, Arbitrum, Solana and The Open Network.

The proceeds were pooled at a single Ethereum address, and the screenshot attached to PeckShield’s alert showed the address holding 5,226.67 ETH worth about $9.73 million. It listed eight incoming transfers between 20:35 UTC Friday and 03:03 UTC Saturday, the largest totaling roughly 4,140 ETH.

Triple-A addressed the reports on X on Saturday. "We're actively investigating the situation and will share a formal update once ready. We confirm that customer funds are not impacted," the company said.

Triple A Technologies Pte. Ltd. is licensed by the Monetary Authority of Singapore as a major payment institution and processes stablecoin payments for merchants that settle in local currency. Its European arm, Paytop SAS, holds payment institution and crypto-asset service provider licenses in France, and the group is registered as a money services business in the U.S. and Canada.

Since Oct. 4, 2024, Singapore’s Payment Services Regulations have required licensed digital payment token service providers to safeguard customer assets in trust accounts, while MAS guidance calls for those assets to be held at blockchain addresses separate from the firms’ own holdings. Triple-A has not identified what the affected wallets contained, saying only that customer funds were not impacted.

Triple-A has not published the promised formal update in its newsroom, where the latest entry remains a July 15 announcement that Dubai’s Virtual Assets Regulatory Authority granted the company in-principle approval for broker-dealer services. That release described compliance as Triple-A's second-largest department after engineering.

The incident follows two other large crypto exploits disclosed this week. AFX Trade, a protocol on Arbitrum, lost about $24.15 million in USDC through its custody bridge in an exploit disclosed Wednesday. The Verus-Ethereum bridge lost roughly $7.54 million the same day, its second breach since May.

The Block was unable to reach Triple-A for comment.