Losses from the drain of crypto payments firm Triple-A's hot wallets have climbed to about $11.8 million, and fresh deposits are still landing in the affected addresses and being swept. Triple-A says it is investigating and that customer funds are not impacted, without saying how the wallets were accessed.
Losses from an apparent compromise of Singapore payments firm Triple-A's hot wallets have grown to roughly $11.8 million, onchain investigator Specter said in a post on X early Sunday. That is up from the more than $9.3 million Specter first flagged at 5:18 p.m. ET on Friday.
Specter said the attacker had swapped the assets and bridged them to Ethereum. Blockchain security firm PeckShield, citing Specter, raised the figure to more than $9.7 million about four and a half hours later.
Deposits keep arriving and being drained
A further $1.8 million had been taken across the Bitcoin and TRON networks, Specter said on Sunday. New deposits were still arriving at the affected wallets and being drained 31 hours after the first large outflows appeared.
Bitcoin had not previously been named among the affected networks. Earlier reports from Specter and PeckShield covered Ethereum, TRON, Polygon, Arbitrum, Solana and The Open Network.
The proceeds were pooled at a single Ethereum address that the screenshot attached to PeckShield's alert showed holding 5,226.67 ETH worth about $9.73 million. Bitcoin and major tokens showed negligible price movement in the hours following the initial reports, according to Crypto Briefing.
Triple-A says customer funds are not impacted
Triple-A addressed the reports on X on Saturday: "We confirm that customer funds are not impacted." The company has not identified what the affected wallets contained.
Nor has it published the promised formal update, and its latest newsroom entry remains a July 15 announcement that Dubai's Virtual Assets Regulatory Authority granted the company in-principle approval for broker-dealer services. Crypto Briefing reported that the firm's cold storage appears to have been untouched, while its hot wallets are kept connected to facilitate real-time settlements.
Triple A Technologies Pte. Ltd. is licensed by the Monetary Authority of Singapore as a major payment institution and processes stablecoin payments for merchants that settle in local currency. Since Oct. 4, 2024, Singapore's Payment Services Regulations have required licensed digital payment token service providers to safeguard customer assets in trust accounts.
Two other exploits surfaced this week
The incident follows two other large crypto exploits disclosed this week. AFX Trade, a protocol on Arbitrum, lost about $24.15 million in USDC through its custody bridge in an exploit disclosed Wednesday. The Verus-Ethereum bridge lost roughly $7.54 million the same day, its second breach since May.
Triple-A could not be reached for comment, The Block said.
Sources: The Block, Crypto Briefing
Trading involves risk.
Risk Disclaimer
