Triple-A exploit analysis

On 25 July 2026, Singapore-based stablecoin payments company Triple-A confirmed that an attacker stole $11.8 million in company funds from its treasury wallets. The company briefly took some services offline while it investigated. Triple-A did not state how much was taken or how the wallets were compromised, and said the impact was limited to "specific operational accounts" and able to be covered by treasury reserves. The blockchain analyst Specter estimated the loss at $11.8 million, stolen across the Bitcoin and Tron networks. The attacker later moved $12.4 million in ETH to Tornado Cash, per a separate report.

The mechanism was not publicly disclosed. Triple-A's statement, posted to its newsroom, did not identify the wallet type, the signature scheme, or the entry point. Crypto.news reported the initial loss at $9.7 million and described the affected wallets as hot wallets. The web3isgoinggreat account put the loss at $11.8 million. The Blockonomist account, citing Specter's analyst thread, said $11.8 million. The Defiant reported the loss at $11.8 million. The discrepancy between the $9.7 million and $11.8 million figures may reflect either a different valuation of mixed assets at the time of the theft or a difference in what counts as operational versus treasury.

The figures are not all aligned. Triple-A's own statement was deliberately vague about the amount. Crypto.news's $9.7 million figure appears to have been the initially-reported number. The $11.8 million figure is the broader analyst estimate. The $12.4 million Tornado Cash figure includes post-attack swapping and may include other assets beyond the originally-stolen balance. The honest reading is that the loss is in the $10-12 million zone and that no single figure should be cited as definitive.

The response was corporate. Triple-A paused some services, made a public disclosure, and stated that reserves would cover the loss. The attacker was not identified by Triple-A in the public reporting. The Tornado Cash movement suggests that the funds are no longer recoverable in their original shape.

Compared with the other payments-company and exchange-style losses in the corpus, Triple-A is part of a small cluster of August 2026 hot-wallet drains. Coinsbuy lost around $8 million on 9 August across Ethereum and Tron, with the wallets later replenished by Coinsbuy itself. Bitget disclosed a $387.5 million loss on 24 September. The Triple-A case sits between them: a payments-company treasury drained through hot-wallet compromise, with the loss covered by reserves. The cross-blockchain nature of the Triple-A drain — Bitcoin and Tron — echoes the Coinsbuy case, which also spanned Ethereum and Tron.