Triple-A, the Singapore payments company that lets merchants take stablecoins and get paid in ordinary money, confirmed on Monday that attackers reached its treasury wallets and took company-owned crypto. The firm has not published a number. The on-chain investigator Specter puts the loss near $11.8 million, and PeckShield's earlier count of the same drain came to $9.7 million spread across at least six blockchains. No client money went with it, and the reason why is the most useful thing in this story.

Triple-A says it detected the unauthorized access on Saturday and pulled its services into maintenance for roughly three hours while it shut the doors. The public confirmation went out earlier today. In between, the whole thing played out in the open, because the wallets involved are readable by anyone with a block explorer and a reason to look.

RelatedKDDI Breach Exposes 14M Users, Passwords in Plaintext

  • Triple-A confirmed unauthorized access to its treasury wallets on Monday, three days after outside analysts first flagged the outflows.
  • Independent estimates of the loss run from $9.7 million to about $11.8 million. The company has not published its own figure and says the hit was absorbed through treasury reserves.
  • Hot wallets on Ethereum, TRON, Polygon, Arbitrum, Solana and TON were drained. Cold storage was not touched.
  • Merchant and client funds were never custodied by Triple-A, so they sat in trust accounts with safeguarding institutions and were unaffected.
Where the drained Triple-A funds came from and where they went Diagram showing hot wallets on Ethereum, TRON, Polygon, Arbitrum, Solana and TON feeding into decentralised exchange swaps and bridges, then consolidating into a single Ethereum address holding roughly 5,227 ETH, while cold storage and client trust accounts remained untouched. FUND FLOW · 25 JULY 2026 What moved, and what never did HOT WALLETS · DRAINED Ethereum TRON Polygon Arbitrum Solana TON DEX swaps and bridges one Ethereum address 5,227 ETH NOT TOUCHED Cold storage long-term company reserves Client funds trust accounts at safeguarding institutions Loss put at $9.7M to $11.8M by outside analysts. Triple-A has published no figure of its own. genztech.blog
Fig 1 The drain hit live operational wallets on six chains. Everything the company had parked and everything it was holding on behalf of others stayed where it was.

What did Triple-A actually confirm?

The statement is narrow and worth reading closely. Triple-A says unauthorized access to its treasury wallets resulted in the loss of company-owned digital assets, that the impact was absorbed through its treasury reserves, and that client funds were not affected because it does not custody digital assets for customers and keeps client money separately in trust accounts with safeguarding institutions. It has notified the Singapore Police Force and brought in cybersecurity specialists and blockchain forensics firms.

What the statement does not include is an amount. Every figure circulating today comes from people reading the chains rather than from the company, which is an odd position for a licensed operator to be in. The ledger is public. Declining to name a number does not make the number private, it just means the public one belongs to somebody else.

  1. Jul 24On-chain analysts flag unusual outflows from wallets tied to Triple-A PeckShield and the investigator Specter among the first
  2. Jul 25Triple-A detects the unauthorized access, services go into maintenance for about three hours the company's own stated detection date
  3. Jul 25-26Stolen assets swapped on decentralised exchanges, bridged to Ethereum, consolidated into a single address holding roughly 5,227 ETH estimates climb from $9.7M toward $11.8M
  4. Jul 27Triple-A publicly confirms the treasury breach and says client funds are unaffected Singapore Police Force notified, forensics firms engaged
  5. NextA final forensic figure, and whatever the Monetary Authority of Singapore decides to say about it neither has arrived

Why did customer money survive a company-wide wallet compromise?

Because there was no customer crypto in the building. Triple-A is a conversion and settlement layer rather than a custodian: a shopper pays in USDC or USDT, the merchant is quoted and paid in fiat, and the company's job is to stand in the middle of that swap and make the timing work. Merchant balances live in trust accounts at safeguarding institutions, which is what Singapore's Payment Services Act requires of a Major Payment Institution.

So the pool an attacker reaches by compromising the operator is the operator's own float. That is not a lucky outcome, it is the outcome the safeguarding rules were written to produce, and this is one of the cleaner demonstrations of them working. It is also the part of the story that gets flattened when a headline says a licensed payments firm was hacked for $12 million, which is true and still leaves the reader with the wrong mental picture.

Treasury hot walletsCold storageClient funds
Whose moneyTriple-A's ownTriple-A's ownMerchants and their customers
Where the keys areLive, signing continuously on six chainsOfflineNo crypto keys at all, fiat held in trust
Why it existsOperational float for settlementReservesMerchant payouts under safeguarding rules
StatusDrainedUntouchedUntouched

What does a stablecoin processor keep in a hot wallet?

This is the mechanism most of the coverage skips. A processor that accepts stablecoins on six chains has to be able to sign transactions on six chains, continuously, without waiting for a human to approve anything. Settlement that takes minutes is the product. Cold storage does nothing for that requirement, because the float has to be reachable at the exact moment a customer taps pay.

The consequence is that the attack surface grows with the chain list. Every additional network a processor supports is a sales feature and another set of live signing keys in production. Triple-A integrates Fireblocks, which narrows how those keys are held and used, and the drain still crossed Ethereum, TRON, Polygon, Arbitrum, Solana and TON in the same window. Whatever the initial access was, it was not chain-specific, which points at the layer above the wallets rather than at any one network.

The money's route afterwards was ordinary. Liquid assets and stablecoins were swapped on decentralised exchanges, the proceeds bridged to Ethereum, and the whole lot consolidated into one address sitting on roughly 5,227 ETH. Consolidating like that is not the behaviour of someone trying to vanish in an afternoon. It is the behaviour of someone parking value in the most liquid asset available while they work out an exit, and it leaves a very legible target for the forensics firms Triple-A just hired.

RelatedAssuranceAmerica Breach Hit 6.9M Driver's Licenses

What should merchants take from this?

One concrete question is worth asking your own processor this week: which pool is my money in, and under whose licence does it sit? There is a real difference between a provider that holds crypto on your behalf and one that converts and settles into a safeguarded fiat account, and that difference decides whether an incident like this is your problem or theirs. Triple-A's merchants found out the good way.

The second thing is less comfortable. A licensed operator with institutional custody infrastructure lost eight figures of its own reserves inside a weekend, and the licence had nothing to say about that, correctly, because operator solvency and customer protection are different jobs. If you are picking a processor on the strength of a regulatory badge, the badge is telling you about your money, not about theirs.

What to watch · next 30 days
  • A company figure. Triple-A absorbing the loss through reserves is a claim about its balance sheet. A confirmed number is how anyone outside checks it.
  • Movement on that address. 5,227 ETH sitting still is a stalemate. The first hop through a mixer or a centralised venue is where attribution usually starts.
  • Any MAS response. A Major Payment Institution losing its own treasury is not a safeguarding failure, but it is the kind of event a regulator asks questions about.
  • The entry point. Six chains in one window means the compromise sat above the wallets. Whether that was a key management system, a cloud account, or a person is the finding that matters for everyone else running this stack.

Our take

The licence did its job and the wallet did not. Singapore's safeguarding rules were written to make sure a payments company failing does not take customer money down with it, and that is precisely the money still standing. Nothing in those rules protects an operator's own operational float, and nothing should. Triple-A ate this one, which is how it is supposed to work.

The part that reads badly is the three days between a public ledger showing a drain and a company confirming it. On-chain analysts had numbers on Friday. Customers had a maintenance window on Saturday and a statement on Monday. For a business whose entire pitch is that blockchain settlement is more transparent than the alternative, being the last party to describe your own incident is a strange look, and it hands the narrative to whoever reads the chain fastest.

Primary sources

Original analysis by GenZTech. Triple-A has published no loss figure; the $9.7M and $11.8M numbers are attributed to PeckShield and the on-chain investigator Specter respectively, as reported by Cointelegraph and Crypto Briefing and read on July 27, 2026.