{"id":"triple-a-treasury-wallet-theft-jul-2026","category":"breach","status":"closed","title":"Triple-A payment processor loses company crypto wallets to social engineering attack","tldr":"Attackers socially engineered a Triple-A engineer and drained the Singapore payment firm's own treasury wallets on 24-25 July 2026. Client funds were not affected. Triple-A has not stated the loss; outside estimates are about US$11.8M. No recovery reported.","summary":"On 25 July 2026 Triple-A, a Singapore crypto payment processor, found that attackers had withdrawn cryptocurrency from operational wallets held by its Singapore entity. Triple-A says the attack started with social engineering of a member of its engineering team, using several communication channels, impersonation and a live call. The attacker then gained higher permissions, deployed malware, reached production databases and misused legitimate API credentials. Triple-A says the stolen assets were its own treasury funds, client money sits separately in segregated trust accounts at banks including DBS and Standard Chartered, and services were restored within about three hours. It did not publish the amount taken. A third-party roundup puts the loss at about US$11.8 million across six blockchains, and Triple-A's own post-mortem names four (TRON, Ethereum, Polygon, Arbitrum), so the sources differ on which chains were hit. As of the 21 August post-mortem, the investigation with Sygnia, zeroShadow, MAS and Singapore Police was ongoing. No recovery, arrests or attribution have been reported.","action":"Nothing for you to do: Triple-A says client funds and settlements were not affected. If you accept crypto payments through Triple-A, check its newsroom or ask your account contact for updates.","product":"Triple-A crypto payment processor (Singapore)","audience":"work","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["triple-a","crypto-theft","social-engineering","hot-wallet","singapore","payment-processor","data-breach"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Triple-A incident post-mortem","url":"https://www.triple-a.io/newsroom/incident-post-mortem","by":"Triple-A","date":"2026-08-21"},{"kind":"news","title":"Hacked crypto exchanges roundup","url":"https://crypto-corner.com/2026/09/26/hacked-crypto-exchanges/","by":"Crypto Corner","date":"2026-09-26"}],"started":"2026-07-25","closed":"2026-09-26","created":"2026-11-03T21:34:56.279Z","updated":"2026-11-03T21:34:56.279Z","cve_notes":[],"timeline":[{"at":"2026-09-26","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"A crypto-hacks roundup listed the theft at about US$11.8 million from hot wallets on six chains (Ethereum, Solana, TRON, TON, Polygon, Arbitrum), swapped and bridged to a single Ethereum address. It mentioned no recovery and named no attacker.","url":"https://crypto-corner.com/2026/09/26/hacked-crypto-exchanges/","by":"Crypto Corner","patch":"na"},{"at":"2026-08-21","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"Triple-A published its post-mortem. The attack began with social engineering of an engineer, then privilege escalation, malware, database access and misuse of legitimate API credentials to withdraw crypto. It did not state the amount taken, said attacker access and persistence had been removed, and said tracing and recovery was ongoing with no promise of getting assets back.","url":"https://www.triple-a.io/newsroom/incident-post-mortem","by":"Triple-A","patch":"na"},{"at":"2026-07-27","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"Triple-A published public updates confirming the loss was limited to its own treasury assets and would be absorbed by company reserves. It engaged Sygnia and zeroShadow for forensics, asset tracing and recovery.","url":"https://www.triple-a.io/newsroom/incident-post-mortem","by":"Triple-A","patch":"na"},{"at":"2026-07-25T05:15Z","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"After containment and initial checks, Triple-A restored services, about three hours after detection by its own account. It said client funds, transactions and settlements were unaffected, and told merchants and key partners directly.","url":"https://www.triple-a.io/newsroom/incident-post-mortem","by":"Triple-A","patch":"na"},{"at":"2026-07-25T02:39Z","added":"2026-11-03T21:32:34.430Z","kind":"disclosed","text":"Triple-A, a Singapore payment processor, identified unauthorised access to wallets run by its Singapore entity that held the company's own digital assets. It started incident response, brought in outside forensics specialists, put some services into maintenance mode and notified Singapore's financial regulator (MAS) and the Singapore Police Force.","url":"https://www.triple-a.io/newsroom/incident-post-mortem","by":"Triple-A","patch":"na"}],"url":"https://hard.fyi/live/triple-a-treasury-wallet-theft-jul-2026/","json":"https://hard.fyi/api/live?id=triple-a-treasury-wallet-theft-jul-2026"}