Triple-A, a Singapore-based crypto payments company, confirmed in an official statement that it identified unauthorised access to certain wallets holding the company’s own digital assets on 25 July.
Client funds were not affected, the company said, since Triple-A does not custody client digital assets and client funds are held separately in trust accounts with safeguarding institutions that were not exposed.
As a precaution, Triple-A placed certain services into maintenance mode for about three hours while it secured the affected infrastructure.
Triple-A has since restored all services, with transactions and settlements processing normally across all markets.
The company said it remains well capitalised and able to meet its liabilities.
It said the financial impact affects only specific operational accounts, and it will fully absorb the cost from its treasury reserves.
Triple-A did not disclose the total value of assets affected or how the breach occurred.
It said it is working with internal and external cybersecurity experts, blockchain forensics specialists, and the Singapore Police Force to investigate, trace the affected assets, and support recovery efforts.
Independent estimates put the loss higher than Triple-A’s own statement suggests.
Blockchain investigator Spectre estimated the loss at approximately $11.8 million, revised up from an initial $9.3 million, according to Unlock Blockchain.
Spectre found that the compromised wallets kept receiving deposits that the attacker immediately swept for more than 31 hours after the initial exploit.
On-chain analysis linked the incident to wallets across seven blockchain networks, including Ethereum, TRON, Polygon, Arbitrum, Solana, The Open Network, and Bitcoin.
Blockchain security firm PeckShield tracked the stolen funds as they were swapped across chains and consolidated into a single Ethereum wallet.
A Multi-Jurisdictional Payments Provider
Triple-A holds a Major Payment Institution licence from the Monetary Authority of Singapore. Through its Paytop SAS entity, it also holds a Payment Institution licence and Crypto-Asset Service Provider registration in the European Union.
In the United States, FinCEN registers Triple-A and licenses it as a money transmitter. FINTRAC and the Bank of Canada also register the company in Canada.
The company provides stablecoin-based payment infrastructure for more than 1,000 enterprise customers, letting businesses send, receive, and convert money without holding digital currencies directly.
Triple-A has built a wide network of partnerships in recent years, including with Coinbase and Crypto.com for consumer crypto payments, payments platform Yuno for merchant stablecoin acceptance, and Circle’s Payments Network for cross-border stablecoin settlement.
Featured image: Edited by Fintech News Philippines based on an image by julianborvel via Magnific.
