Triple-A Crypto Payment Gateway Loses $9.7M in Six-Chain Hot Wallet Exploit

Singapore-based crypto payments firm Triple-A had more than $9.7 million drained from its hot wallets across six blockchains on July 24 and 25. The suspected attacker consolidated roughly 5,227 EETH$1,873.89▲0.60% into a single address — on-chain security alerts first flagged by PeckShield.

The exploit hit Ethereum, TTRX$0.3305▲0.20%, MMATIC, Arbitrum, SSOL$74.55▲1.00%, and TON. That spread is broad enough to suggest either a catastrophic private-key compromise or something far more deliberate than a single-contract bug; it doesn’t read like an accident. At current market prices ETH trades at $1,875, making 5,227 ETH worth approximately $9.8 million — consistent with the reported total drain. The stolen assets were swapped after extraction, according to CryptoNews.net, a pattern typical of attackers trying to break traceability across decentralized exchanges before funds land in a consolidation wallet.

Triple-A has said nothing. The company — a fiat-to-crypto payment gateway that processes transactions for merchants — has not publicly disclosed the incident, and that silence is conspicuous. The Fear & Greed Index sits at 27/100, deep in “Fear” territory as of July 25, and a payment processor losing custody of nearly eight figures across six chains is precisely the kind of event that accelerates withdrawals and erodes counterparty trust before the victim firm utters a word. Triple-A’s incentives to stay quiet are obvious. Its customers’ incentives to be told are stronger.

The six-chain footprint is the detail that should worry anyone using Triple-A’s rails. An exploit confined to one chain might indicate a flawed smart contract or a single integration gone wrong — something contained, something explainable. Hitting Ethereum, TRON, Polygon, Arbitrum, Solana, and TON simultaneously points upstream, to shared key management, a compromised hardware security module, or an insider with access to signing infrastructure across every deployed network. Unverified community discussion has floated compromised private keys or HSMs, insider threats, and malicious contracts as the three most likely causes. None has been confirmed, and none can be without Triple-A’s cooperation, BBTC$64,354.00▲0.40%.com and Cryptometer reported.

Coinpedia confirmed the same six-chain scope. On-chain analytics firm CryptoRank flagged the consolidation of approximately 5,227 ETH into a single address; the attacker’s operational discipline — draining across chains, swapping assets, then consolidating into ETH — reads less like an opportunistic hack and more like a planned extraction carried out by someone who knew exactly how Triple-A’s treasury was structured and where its signing keys lived.

This one lands in the middle of a hot wallet exploit streak. The desk recently covered two Ethereum bridge drains totaling $31.7 million in a single day, and the pattern through 2026 has been clear: hot wallets connected to payment infrastructure and cross-chain bridges remain the softest targets in crypto. The total crypto market cap stands at $2,284.93 billion with 24-hour volume of $41.09 billion, and ETH dominance holds at 9.9%. Both affected chains remain liquid — TRON trades at $0.331, up 0.2% on the day, and Solana sits at $74.66, up 1% — meaning the attacker faces deep order books for offloading. The drained assets show no stress from the incident itself.

The broader market barely flinched. BTC holds at $64,379, up 0.4%, and the top-ten structure is unchanged. Market-level calm is not the story here, though. A payment gateway that moves merchant funds across six chains lost custody of its hot wallets for at least 48 hours; consolidated stolen assets are sitting in a known ETH address; and the victim has said nothing publicly. Watch for whether any affected merchants disclose downstream losses in the coming days — and whether Triple-A breaks its silence before they do.