Singapore Payment Firm Triple-A Loses $11.8M in Wallet Hack

Triple-A has not disclosed how the attackers got in or how much remained in the compromised wallets. The $11.8 million figure comes from blockchain analysis, not from the company's own books.

PeckShield tracked the stolen assets to a single Ethereum wallet that accumulated more than 5,226 ETH – worth about $9.73 million at the time – across eight transactions between late Friday and early Saturday UTC. Specter noted that the compromised wallets kept receiving new deposits even 31 hours after the first large withdrawals, with each fresh deposit immediately swept by the attacker.

Triple-A holds a license from the Monetary Authority of Singapore and payment service authorization in France through its European subsidiary, Paytop SAS. It also has money services business registrations in the United States and Canada.

The company said it has hired cybersecurity consultants, blockchain forensics specialists, and the Singapore Police Force to investigate and attempt asset recovery. It has not published the update it promised Saturday. The press section of its website still shows a July 15 announcement about preliminary regulatory approval from Dubai's Virtual Assets Regulatory Authority.

The incident is one of three notable crypto exploits this week. AFX Trade lost roughly $24.15 million through a vulnerability in its Arbitrum custody bridge. The Verus-Ethereum bridge suffered a $7.54 million breach on the same day – its second major security failure since May.