Cryptocurrency payments company Triple-A is facing an investigation following an apparent breach of its online wallets. According to on-chain investigator Specter, the identified losses reached approximately US$ 11,8 million.
The first alert emerged on Friday, when Specter estimated that more than US$ 9,3 million had been moved by an attacker. The assets were reportedly converted and sent to the Ethereum network.
Hours later, PeckShield raised the estimate to more than US$ 9,7 million. On Sunday, Specter reported that another US$ 1,8 million was withdrawn from the Bitcoin and TRON networks.
The investigator also pointed out that new inflows continued arriving at the affected wallets. The deposits, according to the analysis, were withdrawn up to 31 hours after the first major outflows.
The inclusion of Bitcoin expanded the list of networks involved in the incident. Earlier reports had cited Ethereum, TRON, Polygon, Arbitrum, Solana and The Open Network.
Part of the amounts was concentrated in a single Ethereum address. A screenshot shared by PeckShield showed 5.226,67 ETH, valued at around US$ 9,73 million.
The address received eight transfers between 20h35 UTC on Friday and 3h03 UTC on Saturday. The largest recorded movement reached approximately 4.140 ETH.
Triple-A stated on Saturday that it was investigating the case and said that customer funds were not affected. "We are actively investigating the situation and will release an official update as soon as we are ready. We confirm that customer funds were not affected," the company said.
Triple A Technologies Pte. Ltd. is licensed by the Monetary Authority of Singapore as a major payment institution. The company processes stablecoin payments for merchants with settlement in local currency.
The group also has regulated operations in France, the United States and Canada. In Singapore, rules in force since October de 2024 establish protective measures for customer assets held by licensed digital payment token providers.
MAS guidelines also recommend that these assets remain in blockchain addresses separate from the companies' own funds. So far, Triple-A has not detailed which funds were in the affected wallets.
The case comes after two other cryptocurrency-related breaches this week. AFX Trade lost around US$ 24,15 million in USDC due to a vulnerability in its custody bridge on Arbitrum.
In the same period, the Verus-Ethereum bridge recorded an approximate loss of US$ 7,54 million. The episode marked the second security breach involving the bridge since May.
