Triple-A has confirmed that unauthorized access to its treasury wallets resulted in the loss of company-owned digital assets while stating that client funds and payment operations have remained unaffected.
Summary
- Triple A confirmed unauthorized access to company treasury wallets while saying client funds were not affected.
- The company said the financial impact will be covered by its treasury reserves and normal operations have resumed.
- Onchain investigators had estimated the losses at about $11.8 million before the company acknowledged the breach.
- Triple A is working with cybersecurity experts and Singapore police to investigate and trace the stolen assets.
Triple-A said in a statement on Monday that it detected unauthorized access to certain wallets holding its own digital assets on July 25, prompting the company to temporarily place some services into maintenance mode for about three hours while it secured the affected infrastructure and completed additional security checks.
The Singapore-based stablecoin payments company said all services have since been restored and that transactions and settlements are processing normally across all markets. It added that the incident affected only its treasury assets, with the financial impact limited to specific operational accounts that will be fully absorbed through the company’s treasury reserves.
Client assets were not exposed, according to Triple-A, because the company does not provide digital asset custody services on behalf of customers. Instead, it said client funds are held separately in trust accounts maintained with safeguarding institutions that were not affected by the incident.
Triple-A also said it remains well capitalized, can meet all of its liabilities, and continues to operate globally at normal service levels despite the breach.
Company confirms breach after on-chain investigators flagged suspicious activity
The announcement follows reports from blockchain investigators over the weekend that identified unusual transactions involving wallets linked to Triple-A before the company publicly acknowledged the incident.
On-chain investigator Specter initially estimated that more than $9.3 million had been removed from wallets associated with Triple-A before revising the estimate to more than $9.7 million as additional transfers were identified. The investigator later estimated the losses at about $11.8 million, although Triple-A has not disclosed the total amount of digital assets lost.
Blockchain security firm PeckShield also drew attention to the suspicious transactions after Specter’s initial findings.
Before the company released its statement, researchers had not determined whether the affected wallets contained company funds, customer assets, or payment recipient balances. Triple-A’s latest update clarified that only company-owned treasury assets were impacted and that customer funds remained segregated from the affected infrastructure.
The company has also not disclosed how the unauthorized access occurred or whether the incident resulted from compromised credentials, infrastructure weaknesses, or another attack method. As a result, the exact cause of the breach remains under investigation.
Assets reportedly moved across multiple blockchains
Earlier analysis from Specter indicated that the suspicious activity involved wallets operating on Ethereum, Solana, TRON and TON, while some reports also identified transactions on Polygon and Arbitrum.
According to the on-chain findings, the transferred assets were swapped and bridged to Ethereum after leaving the affected wallets. Researchers reported that the receiving address accumulated approximately 5,226.66 ETH, valued at roughly $9.7 million when the activity was first identified.
Neither Triple-A nor investigators have publicly identified the suspected attacker. At the time of the company’s announcement, there was also no confirmation that the assets had been transferred to a cryptocurrency exchange, a mixer or another laundering service after reaching Ethereum.
Triple-A said it is working with internal and external cybersecurity experts, blockchain forensics specialists and relevant authorities, including the Singapore Police Force, to investigate the incident, trace the affected assets and support recovery efforts.
The company did not provide a timeline for completing the investigation or indicate whether any portion of the stolen assets has been frozen or recovered.
Latest incident adds to active year for crypto security breaches
The incident comes as blockchain security researchers continue to report a steady stream of attacks targeting cryptocurrency platforms and decentralized finance protocols throughout 2026.
Last week, decentralized finance protocol Lien Finance disclosed a loss of about 542,144.63 USDC after attackers exploited flaws in its bond validation and pricing logic. Blockchain security firm SlowMist said the exploit allowed unsupported bond tokens to be created and exchanged for real USDC liquidity without consuming the required collateral.
Separate analysis from DefimonAlerts and researcher exvulsec described the attack as a protocol validation and valuation failure rather than a conventional smart contract exploit, while researchers compared parts of the incident with the earlier Drift Protocol attack because both involved weaknesses in asset valuation rather than cryptographic protections.
Researchers tracking decentralized finance attacks have estimated cumulative losses exceeding $630 million during the first seven months of 2026, identifying oracle manipulation, pricing flaws, compromised credentials and bridge validation weaknesses among the most common attack methods recorded this year.
Another major investigation also remained active this week after wallets tied to the $285 million Drift Protocol exploit resumed moving funds following roughly three months of inactivity. On-chain records showed that more than 23,095 ETH, worth about $44.4 million, was transferred into Tornado Cash, making the movement of stolen assets more difficult to trace.
Be the first to comment