Losses from an apparent compromise of Singapore-based crypto payments firm Triple-A's hot wallets have grown to roughly $11.8 million, according to onchain investigator Specter, who has been tracking the incident since it first surfaced on Friday.
Specter initially flagged the drain at 5:18 p.m. ET on Friday, putting losses at more than $9.3 million and noting that the attacker had swapped the stolen assets and bridged them to Ethereum. Blockchain security firm PeckShield, citing Specter's findings, raised that estimate to more than $9.7 million roughly four and a half hours later.
By Sunday, Specter said a further $1.8 million had been siphoned off across the Bitcoin and TRON networks, with new deposits still arriving at the affected wallets and being drained some 31 hours after the first large outflows appeared. Bitcoin had not previously been named among the affected networks; earlier reports from Specter and PeckShield covered Ethereum, TRON, Polygon, Arbitrum, Solana and The Open Network.
How the Stolen Funds Were Routed
The proceeds were pooled at a single Ethereum address. A screenshot attached to PeckShield's alert showed the address holding 5,226.67 ETH, worth about $9.73 million at the time, across eight incoming transfers recorded between 20:35 UTC Friday and 03:03 UTC Saturday. The largest single transfer totaled roughly 4,140 ETH.
Triple-A addressed the reports on X on Saturday, offering a brief acknowledgment without detailing how the wallets were accessed.
"We're actively investigating the situation and will share a formal update once ready. We confirm that customer funds are not impacted," the company said.
A Licensed Payments Firm Under Scrutiny
Triple A Technologies Pte. Ltd. is licensed by the Monetary Authority of Singapore as a major payment institution and processes stablecoin payments for merchants that settle in local currency. Its European arm, Paytop SAS, holds payment institution and crypto-asset service provider licenses in France, and the group is registered as a money services business in both the United States and Canada.
Since October 4, 2024, Singapore's Payment Services Regulations have required licensed digital payment token service providers to safeguard customer assets in trust accounts, while MAS guidance calls for those assets to be held at blockchain addresses separate from a firm's own holdings. Triple-A has not disclosed what the affected wallets actually contained, saying only that customer funds were not impacted. The company has yet to publish the formal update it promised on Saturday; the latest entry in its newsroom remains a July 15 announcement that Dubai's Virtual Assets Regulatory Authority granted it in-principle approval for broker-dealer services.
Part of a Rough Week for Crypto Custody
The incident follows two other large exploits disclosed this week. Arbitrum-based protocol AFX Trade lost about $24.15 million in USDC through its custody bridge in an exploit disclosed Wednesday, while the Verus-Ethereum bridge lost roughly $7.54 million the same day in its second breach since May.
