Hot wallets belonging to Singapore-based stablecoin payment infrastructure provider Triple-A have allegedly lost over $9.7 million in a security breach. On-chain analyst Specter first spotted a series of anomalous transactions originating from the firm’s wallets. The findings were followed up by blockchain security firm PeckShield, which subsequently alerted the public.
Initial loss estimates were pegged at $9.3 million before being revised upward past the $9.7 million mark. Preliminary tracking indicated the breach hit Triple-A wallets across four major networks: Ethereum, Solana, TRON, and TON. Additional reports from several sources revealed Polygon and Arbitrum were also impacted, expanding the exploit’s scope to six different blockchains.
Consolidation Tactics to a Single Point
Faced with loot from six networks, the attacker used a consolidation tactic. They swiftly swapped various cross-chain assets and funneled all the proceeds into the Ethereum network. By the time the hack alert was issued, the attacker’s receiving address reportedly held 5,226.66 ETH, valued at approximately $9.7 million.
For context, Triple-A is a fully regulated provider. It holds a Major Payment Institution license from the Monetary Authority of Singapore (MAS) and its operations span across the United States and Europe. In March 2026, the company joined the Circle Payments Network to facilitate direct stablecoin settlement into local currencies.
For digital asset security, Triple-A is known to utilize infrastructure provider Fireblocks. Current data confirms that Fireblocks’ infrastructure was not the hacker’s entry point in this exploit. The incident was also confirmed to have no connection whatsoever to the attack on Across Protocol on the Solana network on July 17 of the same week.
Unclear Service Status
As of press time, Triple-A has not issued a public confirmation regarding the exploit. There has been no official statement detailing when the suspicious activity actually began or how the hacker managed to gain access to its hot wallets.
A crucial question for the ecosystem remains the status of the stolen assets. It is not yet clear whether the $9.7 million consisted purely of Triple-A’s operational funds, business client funds, or capital intended for payment recipients. Given that Triple-A operates in the United States, the incident could potentially raise regulatory concerns and counterparty risks, although there is currently no evidence of direct losses suffered by US clients.
The company has also not clarified the status of its operational services. It remains uncertain whether deposits, withdrawals, or cross-chain transactions have been temporarily suspended or remain active. For business clients relying on this licensed payment provider, the initial hours following the hack have turned into an uncertain waiting period regarding the fate of their liquidity.
Reported via crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
