Triple-A hot wallet losses reach $12M amid security incident

Triple-A hot wallet losses reach $12M amid security incident Singapore-based crypto payments gateway says customer funds are safe after exploit drained wallets across six blockchains Share Add us on Google by Editorial Team Jul. 26, 2026 Triple-A, a licensed crypto payments gateway based in Singapore, is dealing with a security breach that drained an estimated $12M from the company’s hot wallets across multiple blockchains. The incident, first flagged by blockchain analysts on July 24, marks yet another reminder that the plumbing behind crypto’s growing payments infrastructure remains a favorite target for attackers.

The company confirmed it is investigating the incident and stated that customer funds are not affected. What happened and how the funds moved Blockchain security firm PeckShield and on-chain investigator Specter were among the first to identify suspicious outflows from Triple-A’s wallets. The drain hit hot wallets on at least six separate chains: Ethereum, TRON, Polygon, Arbitrum, Solana, and TON.

Estimates of the total loss vary. Some initial reports pegged the figure at $9.7M, while subsequent tracking pushed it closer to $12M.

On-chain data shows the exploited funds were consolidated into a single Ethereum address holding roughly 5,227 ETH. Advertisement Triple-A’s cold storage, the offline vaults where the bulk of assets are typically held, appears to have been untouched. The company’s hot wallets, by contrast, are kept connected to facilitate real-time settlements, which makes them inherently more exposed.

Who is Triple-A and why it matters Founded in 2017, Triple-A positions itself as a fiat-to-crypto payments bridge for merchants. The company lets businesses accept stablecoins like USDC, USDT, and DAI while settling in fiat currency. The company holds a Major Payment Institution license from Singapore’s Monetary Authority of Singapore (MAS), along with regulatory authorizations in the US and EU.

It integrates with Fireblocks, one of the most widely used institutional custody and wallet infrastructure providers, for its security stack. But $12M drained across six chains simultaneously suggests either a compromised private key, a vulnerability in the wallet management layer, or an insider threat. A pattern the industry can’t shake Look at the market reaction to this one.

Bitcoin barely flinched. Major tokens showed negligible price movement in the hours following the initial reports. What investors and merchants should watch The immediate question for Triple-A’s merchant clients is whether the company has sufficient reserves to absorb the loss without disrupting operations.

The firm’s claim that customer funds are unaffected implies the drained wallets contained operational or treasury funds rather than client deposits. Fireblocks integration, MAS licensing, and multi-jurisdictional compliance don’t eliminate the fundamental risk of keeping assets in internet-connected wallets. They mitigate it.

They add layers of key management and access controls. But as this breach demonstrates, no layer is impenetrable. Investors evaluating crypto payments companies should be stress-testing their security assumptions.

Specifically: what percentage of assets does the platform keep in hot wallets? What’s the key management architecture? Is there insurance coverage for operational losses?

Regulators in Singapore, the US, and the EU will likely be watching how Triple-A handles disclosure and remediation. MAS in particular has been building out its digital payment token framework, and a licensed entity suffering a multi-million-dollar exploit is exactly the kind of event that accelerates rulemaking around custody standards and hot wallet limits. Disclosure: This article was edited by Editorial Team.

For more information on how we create and review content, see our Editorial Policy. MARKETS Triple-A hot wallet losses reach $12M amid security incident Singapore-based crypto payments gateway says customer funds are safe after exploit drained wallets across six blockchains by Editorial Team Jul. 26, 2026 Share Add us on Google Triple-A, a licensed crypto payments gateway based in Singapore, is dealing with a security breach that drained an estimated $12M from the company’s hot wallets across multiple blockchains.

The incident, first flagged by blockchain analysts on July 24, marks yet another reminder that the plumbing behind crypto’s growing payments infrastructure remains a favorite target for attackers. The company confirmed it is investigating the incident and stated that customer funds are not affected. What happened and how the funds moved Blockchain security firm PeckShield and on-chain investigator Specter were among the first to identify suspicious outflows from Triple-A’s wallets.

The drain hit hot wallets on at least six separate chains: Ethereum, TRON, Polygon, Arbitrum, Solana, and TON. Estimates of the total loss vary. Some initial reports pegged the figure at $9.

7M, while subsequent tracking push