Triple-A hack — July 2026

Triple-A, a Singapore-licensed digital payments company, had hot wallets holding its own corporate assets drained across seven blockchains: Ethereum, Tron, Polygon, Arbitrum, Solana, The Open Network and Bitcoin.

On-chain analysis by Scorechain places the start of the unusual outflows at about 19:34 UTC on 24 July 2026. The draining continued for roughly 31 hours, with the attacker sweeping newly arriving deposits during the attack window. That is why published estimates rose across the weekend, from about $9.3 million when the activity was first reported, to $9.7 million, and finally to about $11.8 million; PeckShield's figure of $9.7 million remains the headline in some reporting. PeckShield tracked the attacker swapping stolen assets on decentralised exchanges and bridging proceeds to Ethereum, where roughly 5,227 ETH was consolidated in a single address; Scorechain puts the consolidated hoard slightly higher at about 5,287 ETH, worth close to $9.94 million. Scorechain's trace found roughly 78 percent of the value moved through Relay, Chainflip, deBridge and CoW Swap, and that the consolidated ether was converted into about $9.87 million of DAI on 28 July.

Triple-A confirmed the incident, saying it identified unauthorised access on 25 July 2026 to wallets containing the company's own digital assets, that certain services were placed in maintenance mode for about three hours while the affected infrastructure was secured, and that it is working with internal and external cybersecurity experts, blockchain forensics specialists and the relevant authorities including the Singapore Police Force. The company said client funds were not affected because it does not provide digital asset custody for clients; client money is held separately in trust accounts with safeguarding institutions that were not exposed. The incident was limited to Triple A Technologies Pte. Ltd., its Singapore entity. Triple-A has not published a loss figure of its own, said the financial impact is confined to specific operational accounts and is being absorbed from treasury reserves, and has not disclosed a root cause.