Triple-A, a crypto payment infrastructure provider, reportedly lost over $9.7 million after a significant security breach targeted its hot wallets on several blockchain networks. Blockchain security firms and analysts tracking the event claimed that the attacker executed complex movements across multiple chains before consolidating the funds into a single Ethereum wallet. Triple-A has yet to confirm the incident or disclose whether customer funds or company reserves were at risk.
Attack Details and Initial Discovery
On-chain analyst Specter was the first to detect suspicious activity involving wallets attributed to Triple-A, initially estimating the losses at over $9.3 million. As the situation developed, further tracking pushed the total above $9.7 million. PeckShield, another blockchain security firm, later supported these findings, stating that the attacker exploited hot wallets operating across TRON, Ethereum, Polygon, and Arbitrum.
Investigators also observed signs that the exploit traced back to Solana and TON, suggesting a broader impact spanning a range of blockchain ecosystems. Researchers explained that once the attacker gained access, they rapidly swapped stolen tokens into different cryptocurrencies before bridging assets over to Ethereum for consolidation.
According to on-chain data, the attack resulted in the creation of a single Ethereum address controlling approximately 5,227 ETH, with a value of $9.7 million at the time of the incident. Security teams noted the coordinated nature of the swaps, bridging transactions, and subsequent consolidation of assets.
Specter and PeckShield reported that more than $9.7 million worth of crypto assets were siphoned from Triple-A’s hot wallets across several chains. The attacker used swaps and bridges to move stolen funds to Ethereum, where 5,227 ETH are currently held at a single destination.
Researchers additionally mapped out multiple wallet addresses linked to the suspicious transfers but did not attribute the attack to any known hacking group. No connections have been made to previous security incidents involving similar wallet infrastructure.
Ongoing Security Challenges for Hot Wallets
The breach reinforces persistent concerns over the vulnerability of hot wallets, which remain connected to the internet for prompt transaction processing. While convenient for crypto payments, this configuration increases exposure to potential attacks compared to offline cold storage.
Security experts believe the attacker likely accessed Triple-A’s hot wallet systems before funneling liquid assets through decentralized exchanges and bridges. They also stated that the movement of funds into a single Ethereum address allows for more streamlined control and potential future withdrawals.
The evolving loss figures, moving from initial estimates of $9.3 million to $9.7 million, likely reflect ongoing asset movements and fluctuations in Ethereum’s market price during the course of the investigation. The situation unfolded during a week marked by separate exploits against other crypto companies, including AFX Trade, Verus Ethereum Bridge, and B2 Network.
CryptoAppsy, which requires no account creation hassle, combines your crypto investments with real-time prices, detailed charts, and multi-currency portfolio management on a single screen. With this all-in-one financial assistant, you can instantly seize opportunities by setting up smart price alerts, filter news specific to your coins, discover newly listed altcoins without missing them, and always stay one step ahead of the market with critical macroeconomic data such as Fed interest rates.
So far, investigators have not found evidence connecting the Triple-A incident to the other recent attacks. The growing list of multi-chain security breaches highlights the urgent need for enhanced wallet security and monitoring tools in the digital asset industry.
Triple-A has not responded with an official comment or provided clarity regarding the full scope of the losses. The exact amount and the mechanism behind the suspected exploit are still unconfirmed as the company continues its internal investigation.
