On July 24-25, 2026, Triple-A's hot wallets were drained across 7 blockchains (TRON, Ethereum, Arbitrum, TON, Solana). The initial $9.7M loss was revised to $11.8M as attackers maintained access for 31+ hours.

Singapore-based stablecoin payments firm Triple-A suffered unauthorized access to its hot wallets across multiple chains, with attackers draining approximately $9.7M–$11.8M in company-owned digital assets that were swapped and bridged/consolidated to a single Ethereum address. Client funds remained unaffected in separate trust accounts; services were briefly paused for security checks and have been fully restored.