On-chain data shows 5,280 ETH draining into single address following quiet Triple-A wallet breach

Triple-A, a Singapore-based stablecoin payments firm, said unauthorized access to wallets holding its own digital assets was contained without affecting client money. The company has not disclosed the size of its treasury loss or explained how the wallets were accessed.

Triple-A said it identified the incident on July 25. In its July 27 statement, the firm said it does not custody digital assets for clients and holds client funds separately in trust accounts with safeguarding institutions that were not exposed.

Certain services were placed in maintenance mode for approximately three hours while the company secured the affected infrastructure and ran security checks. Triple-A later said all services had been restored and that transactions and settlements were processing normally across all markets.

Related Reading

Polymarket suffers live POL drain as team rules out feared contract exploit

Team statements point to a Polymarket private key compromise rather than core contracts or user funds.

May 22, 2026 · Liam ‘Akiba’ Wright

The company said the financial impact was limited to specific operational accounts and was being fully absorbed from treasury reserves. It also said the affected wallets were operated by Triple A Technologies Pte. Ltd., its Singapore entity, and that other group entities and operations were unaffected. The statement disclosed no asset list, wallet addresses or loss figure, though Triple-A said it remained able to meet its liabilities.

What the public wallet trail shows

Onchain analyst Specter identified 0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1 as an Ethereum address where funds linked to the incident were being consolidated. Etherscan records show 12 inbound transfers of more than 0.01 ETH into that address on July 24 and July 25, totaling 5,287.08568411 ETH.

Related Reading

Crypto hacks hit a record count but the biggest threat isn’t smart contracts

The industry’s security problem is changing shape: more hacks, lower typical losses, and a handful of infrastructure compromises still defining the first half’s damage.

Jul 5, 2026 · Liam ‘Akiba’ Wright

Those transfers establish the flow into the cited address, but they do not establish when the unauthorized access began or how much Triple-A lost. The company has not confirmed the address, identified the source wallets, or described their account roles and original assets before swaps and bridges. That missing link also means the public flows do not contradict Triple-A’s client-fund segregation claim but cannot independently verify it.

The Monetary Authority of Singapore lists Triple A Technologies Pte. Ltd. as a Major Payment Institution authorized for domestic and cross-border transfers, merchant acquisition and digital payment token services. MAS says institutions in that license class must comply with customer-money protection requirements. The directory establishes the regulatory obligation, not whether Triple-A satisfied it during this incident.

Related Reading

Why crypto hacks don’t end and continue even when the money is gone

A crypto exploit can empty a wallet in minutes, but the full damage often unfolds for months. Tokens keep falling, treasuries shrink, hiring freezes set in, and projects that survive the theft can still lose their future in the aftermath.

Mar 22, 2026 · Andjela Radmilac

Triple-A said it is working with cybersecurity and blockchain-forensics specialists, the Singapore Police Force and other authorities to trace assets and support recovery. The two central unknowns remain the size of the treasury loss and the route by which the wallets were accessed.