Triple-A Loses $11.8 Million in Treasury Wallet Breach

Singapore-based Triple-A processes stablecoin payments for merchants that settle in local currencies and is licensed by the Monetary Authority of Singapore as a major payment institution. The breach matters because hot wallets stay connected to blockchain networks to support day-to-day transactions, leaving them more exposed than offline storage. Triple-A said the affected wallets held corporate treasury assets, while client funds were segregated in trust accounts with safeguarding institutions and were not exposed.

Onchain investigator Specter first flagged more than $9.3 million of suspicious outflows on July 24. By July 26, another $1.8 million had been drained over Bitcoin and TRON, lifting estimated losses to about $11.8 million; fresh deposits were still being swept 31 hours after the first major transfers. Triple-A confirmed on July 27 that unauthorized parties accessed treasury wallets on July 25. It said some services entered maintenance for about three hours, operations had resumed, and it was working with cybersecurity specialists, blockchain forensics firms and the Singapore Police Force.