Key Takeaways
- Triple-A lost over $9.7 million from hot wallets across six chains, per Peckshield.
- The attacker bridged proceeds to Ethereum, consolidating roughly 5,227 ETH in one address.
- Triple-A had issued no public statement more than eight hours after the breach was flagged.
Onchain Investigator Flags the Breach First
Onchain investigator Specter first reported the incident. According to a Peckshield alert published Saturday, wallets tied to Triple-A, a Singapore-based fiat-to-crypto payment gateway, had been drained of funds across Ethereum, Tron, Polygon, Arbitrum, Solana and The Open Network (TON).
Triple-A operates payment infrastructure that lets merchants accept cryptocurrency and settle in fiat currency, meaning its hot wallets hold a rotating pool of customer funds and liquid stablecoins to process transactions quickly. Hot wallets stay connected to the internet for speed, a tradeoff that makes them more exposed than offline cold storage.
Onchain data reviewed by security researchers shows the attacker swapped stolen stablecoins and other liquid assets on decentralized exchanges before bridging the proceeds to Ethereum. The funds landed in a single address beginning with 0x01F8, which held roughly 5,227 ETH, worth about $9.7 million, as of Saturday.
Image source: X
The consolidated wallet received the stolen assets in several tranches rather than one lump transfer, a move that is in line with nefarious actors of the past involved with methodically converting assets across multiple chains before regrouping them.
Lastly, it bears mentioning that Peckshield has flagged similar bridge-to-Ethereum consolidation before, including a suspected exploit that saw $5.25 million bridged from Hedera to Ethereum just a couple of weeks ago.
A Familiar Pattern for Payment Infrastructure
Triple-A joins a growing list of crypto payment processors and exchanges targeted for hot wallet compromises this year. Attacks on Web3 infrastructure firms often follow a similar arc, i.e., attackers gain access to a hot wallets private keys or a misconfigured smart contract, drain liquid assets quickly, then launder proceeds through decentralized exchanges (DEXs) and cross-chain bridges before centralized platforms can freeze funds.
A mirror identical playbook was witnessed when the Gravity Bridge was drained of $5.4 million in May, with the attacker routing stolen funds through Binance to obscure the trail. Not only that, the cybersecurity giant has found that the industry lost $75.87 million to 40 separate hacks just in June alone, a 7.13% drop from Mays $81.7 million (with hot wallet compromises remaining among the most common attack vectors alongside smart contract bugs and private key leaks).
No Remedial Measures Taken
More than eight hours after the breach was first flagged, Triple-A is yet to issue an official statement acknowledging the exploit or detailing what customer funds, if any, were affected. The silence leaves open questions about whether merchants using Triple-As payment rails experienced any disruption to settlement, and whether the company holds reserves sufficient to make affected users whole.
Over the coming few hours, security researchers will likely continue tracking the consolidated Ethereum address for signs that the attacker moves funds toward centralized exchanges or a mixing service, a step that could offer investigators a chance to flag the wallet before proceeds are cashed out.