Triple-A Hot Wallets Drained of $9.7 Million Across Six Chains

Triple-A, a Singapore-based fiat-to-crypto payment gateway, suffered a hot wallet breach on July 24 and 25, resulting in over $9.7 million being drained from its wallets across six blockchains.

The incident was first reported by Specter, an onchain investigator, and later confirmed by Peckshield, which monitors security alerts.

The attacker bridged the stolen funds to Ethereum, consolidating roughly 5,227 ETH in a single address. This is a common tactic used by nefarious actors, who often break down large sums into smaller transactions to avoid detection.

This attack follows a familiar pattern for payment infrastructure firms, with attackers gaining access to hot wallet private keys or misconfigured smart contracts and quickly draining liquid assets before laundering them through decentralized exchanges (DEXs) and cross-chain bridges.