Triple-A Hot Wallet Hack: How Losses Grew from $9.3M to $11.8M in 31 Hours Across 7 Blockchains

On July 24, 2026, Singapore-based crypto payment gateway Triple-A became the latest victim of a major hot wallet exploit. What started as an estimated $9.3 million theft rapidly escalated over the next 31 hours, ultimately reaching $11.8 million as attackers drained newly arriving deposits. The incident spanned seven blockchains and highlighted a growing trend in crypto security breaches: attackers targeting operational infrastructure rather than smart contract vulnerabilities.

The Attack and Escalating Losses

On-chain investigator Specter first detected the compromise of Triple-A's hot wallets on Friday, July 24, 2026 at 5:18 p.m. ET, with an initial estimate of $9.3 million stolen across multiple blockchains . Over the following 31 hours, the loss figure grew to approximately $11.8 million as new deposits continued arriving at the compromised wallets and were immediately drained by the attacker . This "bleeding" pattern — where a hot wallet key is compromised but the wallet remains live, automatically draining any new incoming funds — distinguishes this incident from a one-time exploit.

Affected Networks

The attacker drained assets across seven blockchain networks: Ethereum, TRON, Polygon, Arbitrum, Solana, The Open Network (TON), and Bitcoin . The multi-chain nature of the attack required the attacker to swap and bridge assets efficiently, indicating a sophisticated operation.

Asset Consolidation and On-Chain Movement

A distinctive feature of the exploit was the attacker's method of consolidating funds. The attacker swapped stolen stablecoins on decentralized exchanges and bridged all proceeds to a single Ethereum address that ultimately held approximately 5,227 ETH, valued at roughly $9.73 million at the time . This consolidation pattern is typical of hot-wallet exploits where the attacker converts non-native assets into ETH for easier movement or laundering .

Triple-A's Response and Asset Segregation

Triple-A confirmed the treasury wallet breach and stated that customer funds were not impacted — the compromised wallets were corporate treasury wallets, not client custodial accounts . The company said it would absorb the financial impact directly and was actively investigating the incident . This highlights a critical security architecture: Triple-A's customer asset segregation model kept client funds held in dedicated safeguarded accounts separate from the operational treasury wallets that were compromised .

Triple-A's Regulatory Standing

Triple-A is a Singapore-based fiat-to-crypto payment gateway founded in 2020. It holds one of the broadest license stacks in the crypto payments sector:

• A Major Payment Institution (MPI) license from the Monetary Authority of Singapore (MAS)
• A MiCA Crypto-Asset Service Provider (CASP) license from France's AMF, authorizing services across all 30 EU/EEA states
• In-principle approval from Dubai's Virtual Assets Regulatory Authority (VARA) for broker-dealer services

The company had also established partnerships with Mastercard to strengthen cross-border payment infrastructure .

Broader 2026 Crypto Hack Landscape

The Triple-A hack did not occur in isolation. Multiple security firms reported record or near-record hacking activity in H1 2026:

Source	Total H1 2026 Losses	Incident Count	Key Vectors
TRM Labs	$972 million	207 hacks	Operational compromises, key management
Immunefi	~$972 million	207 incidents	Record high incident count
CertiK	~$1.32 billion	344 incidents	Multi-chain exploits
PeckShield	~$750 million+	~200+	Bridge vulns, smart contract flaws, compromised private keys

PeckShield specifically highlighted that the most common attack vectors in H1 2026 were bridge vulnerabilities, smart contract flaws, and compromised private keys . TRM Labs noted that operational compromises — including key management and signing infrastructure — now represent a larger share of losses than pure smart-contract exploits . North Korea-linked groups were blamed for roughly $643 million (~66%) of total H1 losses .

Immunefi reported that while total losses fell below $1 billion for the first half of 2026 — less than half of the $2.3 billion stolen in H1 2025 — the incident count of 207 was the highest ever recorded . The Block similarly noted that the most severe damage increasingly stems from infrastructure failures, private key compromises, cross-chain configuration errors, and weaknesses in privileged access .

Key Caveats

• Reports differ on the final loss figure: Specter's on-chain tracking settled at $11.8M, while some outlets reported $12M .
• The Bitcoin network was listed among affected chains in some reports but not all, suggesting Bitcoin involvement may have been indirect or a smaller portion of the total .
• Triple-A's customer fund assurances relate specifically to client custodial accounts being segregated from the compromised treasury wallets .

What This Means

The Triple-A hot wallet hack is a textbook example of the evolving threat landscape in crypto. The attacker did not exploit a smart contract bug; they compromised a hot wallet's private key — a type of operational failure that now accounts for the majority of stolen value in 2026. For regulated payment gateways with multiple licenses, the incident demonstrates both the importance of asset segregation (which protected customer funds) and the persistent vulnerability of hot wallet infrastructure. As the industry heads into the second half of 2026, the lesson is clear: securing private keys and operational infrastructure is now more critical than auditing smart contract code.