Triple-A payment processor loses company crypto wallets to social engineering attack
Attackers socially engineered a Triple-A engineer and drained the Singapore payment firm's own treasury wallets on 24-25 July 2026. Client funds were not affected. Triple-A has not stated the loss; outside estimates are about US$11.8M. No recovery reported.
Nothing for you to do: Triple-A says client funds and settlements were not affected. If you accept crypto payments through Triple-A, check its newsroom or ask your account contact for updates.
What’s happening
On 25 July 2026 Triple-A, a Singapore crypto payment processor, found that attackers had withdrawn cryptocurrency from operational wallets held by its Singapore entity. Triple-A says the attack started with social engineering of a member of its engineering team, using several communication channels, impersonation and a live call. The attacker then gained higher permissions, deployed malware, reached production databases and misused legitimate API credentials. Triple-A says the stolen assets were its own treasury funds, client money sits separately in segregated trust accounts at banks including DBS and Standard Chartered, and services were restored within about three hours. It did not publish the amount taken. A third-party roundup puts the loss at about US$11.8 million across six blockchains, and Triple-A's own post-mortem names four (TRON, Ethereum, Polygon, Arbitrum), so the sources differ on which chains were hit. As of the 21 August post-mortem, the investigation with Sygnia, zeroShadow, MAS and Singapore Police was ongoing. No recovery, arrests or attribution have been reported.
- What
- Breach
- Affects
- Triple-A crypto payment processor (Singapore)
- Fixed in
- Nothing to patch
- Since
- 25 July 2026
- Closed
- 26 Sept 2026
Timeline
- UpdateNothing to patch
A crypto-hacks roundup listed the theft at about US$11.8 million from hot wallets on six chains (Ethereum, Solana, TRON, TON, Polygon, Arbitrum), swapped and bridged to a single Ethereum address. It mentioned no recovery and named no attacker.
- UpdateNothing to patch
Triple-A published its post-mortem. The attack began with social engineering of an engineer, then privilege escalation, malware, database access and misuse of legitimate API credentials to withdraw crypto. It did not state the amount taken, said attacker access and persistence had been removed, and said tracing and recovery was ongoing with no promise of getting assets back.
- UpdateNothing to patch
Triple-A published public updates confirming the loss was limited to its own treasury assets and would be absorbed by company reserves. It engaged Sygnia and zeroShadow for forensics, asset tracing and recovery.
- UpdateNothing to patch
After containment and initial checks, Triple-A restored services, about three hours after detection by its own account. It said client funds, transactions and settlements were unaffected, and told merchants and key partners directly.
- Made publicNothing to patch
Triple-A, a Singapore payment processor, identified unauthorised access to wallets run by its Singapore entity that held the company's own digital assets. It started incident response, brought in outside forensics specialists, put some services into maintenance mode and notified Singapore's financial regulator (MAS) and the Singapore Police Force.
Sources
- Triple-A incident post-mortemTriple-A · 21 Aug 2026
- Hacked crypto exchanges roundupCrypto Corner · 26 Sept 2026