Triple-A Multi-Chain Hot Wallet Compromise

T0 — July 24, 2026, ~21:18 UTC: On-chain analyst Specter first flags suspicious outflows from wallets linked to Triple-A, putting initial damage at approximately $9.3 million. T+~4.5h: PeckShield amplifies the alert, raising the estimate to over $9.7 million and identifying that ~5,227 ETH of bridged proceeds were being consolidated at a single Ethereum address beginning 0x01F8. Deposits into the compromised wallets were not disabled, and new incoming funds continued to be swept for at least 31 hours after the first large outflows were detected — Specter noted the team did not appear aware, since deposits remained open. July 26 (Saturday): Triple-A internally detects the breach and places certain services into maintenance mode for approximately three hours to secure infrastructure and complete checks; no public statement is issued at this point. By July 27 (Sunday), the cumulative loss figure had climbed to $11.8 million as transfers continued to be traced. July 27: Triple-A officially and publicly acknowledges the incident, stating attackers gained unauthorized access to wallets holding the company's own digital assets (not customer funds, which remain protected in segregated trust accounts under Singapore's Payment Services Regulations). The company confirms it is working with cybersecurity firms, blockchain forensics teams, and the Singapore Police Force to trace and recover the stolen assets. All services are confirmed restored and processing normally across markets. As of the most recent reporting, the consolidated Ethereum address holding ~5,227 ETH has not moved further, and 0% of funds have been recovered.