TheBlock
Onchain investigator Specter said losses from a hot-wallet drain tied to Singapore payments firm Triple-A have climbed to roughly $11.8 million, up from an initial $9.3 million estimate on Friday. The growing gap is the telling detail: new deposits landing in the affected wallets are still being swept.
Why it matters
Triple-A, a payments processor licensed by the Monetary Authority of Singapore, handles stablecoin payment rails for merchants. The firm has confirmed it is investigating and has told customers their funds are not affected, a position that gets harder to defend with each onchain tick. The firm has not disclosed the initial access vector, and the live draining of fresh deposits suggests the attacker still controls the keys rather than working from a one-time snapshot.
Market impact
Hot-wallet drains are the most preventable class of crypto loss, and the live-sweep pattern reads less like an old vulnerability being exploited and more like keys that have not yet been rotated. For a regulated Singapore payments venue, the reputational arithmetic is worse than the dollar figure: counterparties and stablecoin partners will be asking how the $2.5M in additional funds passed through to attackers between Friday and now without triggering an internal pause.
Frequently asked questions
-
What happened to Triple-A's hot wallets?
Onchain investigator Specter said losses from a hot-wallet drain tied to Singapore payments firm Triple-A have climbed to about $11.8 million, up from an initial $9.3 million estimate on Friday, with new deposits still being swept.
-
Is Triple-A a regulated company?
Triple-A is a Singapore payments firm licensed by the Monetary Authority of Singapore and processes stablecoin payment rails for merchants.
-
Are customer funds affected by the Triple-A drain?
Triple-A has said customer funds are not affected, though it has not disclosed how the wallets were accessed and the figure continues to rise.
-
Why are the losses still climbing?
Specter said new deposits landing in the affected wallets continue to be drained, which suggests the attacker still controls the private keys rather than working from a one-time snapshot.
-
What is the reputational risk for Triple-A?
For a regulated Singapore payments venue, the reputational arithmetic is worse than the dollar figure: counterparties and stablecoin partners will ask how roughly $2.5M in additional funds passed through to attackers between Friday and the latest update without an internal pause.
CryptoSlate
CoinTelegraph
CoinDesk
WuBlockchain