Triple-A Wallet Hack Reaches $11.8M as New Deposits Keep Flowing

The rising loss estimate is material. The continued arrival of deposits at affected wallets may be the larger concern. It suggests that stopping the initial drain did not immediately prevent more assets from entering the compromised infrastructure.

Triple-A is licensed by the Monetary Authority of Singapore as a major payment institution and processes stablecoin payments for merchants that receive settlement in local currencies. Its European subsidiary, Paytop SAS, holds payment institution and crypto-asset service provider licenses in France. The group is registered as a money services business in the United States and Canada.

Singapore’s Payment Services Regulations have required licensed digital payment token providers to safeguard customer assets in trust accounts since Oct. 4, 2024. Regulatory guidance also calls for customer assets to be held at blockchain addresses separated from a company’s own operational holdings.

Triple-A’s statement that customer funds were unaffected may mean the drained wallets contained company-owned liquidity or operational assets rather than safeguarded client holdings. The company has not identified the assets held in the affected wallets, however, leaving the accounting and operational impact unclear.

The distinction matters because a loss involving corporate treasury funds would create a direct financial cost for Triple-A. A breach involving customer assets could raise wider custody, reimbursement and regulatory questions.

Triple-A had not published its promised formal update in its newsroom by Sunday. Its latest public entry remained a July 15 announcement that Dubai’s Virtual Assets Regulatory Authority had granted the company in-principle approval for broker-dealer services.

The next update will need to explain how the wallets were accessed, which entities owned the lost assets and whether the company has stopped deposits from reaching compromised addresses. Users and regulators may also seek details on wallet segregation, key management and the controls used to detect abnormal withdrawals.

The incident follows two other large crypto exploits disclosed during the same week. AFX Trade, a protocol operating on Arbitrum, lost about $24.15 million in USDC through its custody bridge. The Verus-Ethereum bridge lost roughly $7.54 million in its second breach since May.

For payment firms, the Triple-A case shows that regulatory licensing does not remove technical and operational risks. The financial impact will depend on whether the company can recover any funds, identify the access method and prove that safeguarded customer assets remained isolated throughout the drain.