Triple-A loses $11.8M in treasury wallet breach across 7 blockchains

Triple-A, a Singapore-licensed crypto payments firm, lost $11.8 million in company-owned digital assets after unauthorized access to its treasury wallets over the weekend.

"The unauthorized access was detected on Saturday, and certain services were temporarily placed into maintenance mode for approximately three hours while we secured the affected infrastructure," a Triple-A spokesperson said. The company confirmed client funds were not impacted because it does not custody digital assets on behalf of customers, keeping client funds in segregated trust accounts with safeguarding institutions.

Blockchain security firm PeckShield and on-chain analyst Specter first flagged suspicious outflows on July 25, initially estimating losses at $9.3 million. The total climbed to $11.8 million as attackers continued draining incoming deposits across seven blockchain networks — Ethereum, TRON, Polygon, Arbitrum, Solana, The Open Network and Bitcoin — more than 31 hours after the initial breach. Stolen assets were consolidated into a single Ethereum wallet that accumulated over 5,226 ETH, valued at approximately $9.73 million as of 14:00 UTC on July 26.

The breach adds to a difficult stretch for crypto security, following three separate attacks on July 23 that cost AFX Trade $24.15 million and the Verus-Ethereum bridge $7.54 million. Triple-A said it is working with cybersecurity specialists, blockchain forensics firms and the Singapore Police Force to trace the assets and support recovery efforts. The company operates under a license from the Monetary Authority of Singapore and holds payment service authorization in France via its subsidiary Paytop SAS.

Triple-A did not disclose the total holdings in the affected treasury wallets or the specific attack vector. The $11.8 million loss figure originates from blockchain analysis conducted by Specter and PeckShield rather than official company statements. The firm's press section still displays a July 15 announcement regarding preliminary regulatory approval from Dubai's Virtual Assets Regulatory Authority, and the company has not yet released the comprehensive update it committed to providing on Saturday.

This article is for informational purposes only and does not constitute investment advice.