Triple-A Confirms Wallet Breach but Says Client Funds Were Safe

Singapore-based payments company Triple-A has confirmed that unauthorized parties accessed several wallets holding its own digital assets on July 25, 2026.

In an official statement published Monday, the firm stressed that client money was not affected and that the incident was limited to specific operational accounts.

Triple-A said it does not custody digital assets for customers. Client funds are instead held separately in trust accounts with safeguarding institutions, which the company said were not exposed during the breach.

The firm temporarily placed some services into maintenance mode for around three hours while it secured its infrastructure and completed checks. All services have since returned, with transactions and settlements processing normally across its markets, according to the statement.

Triple-A did not disclose the exact value of the affected assets or explain how the wallets were accessed. However, on-chain analyst Specter and blockchain security firm PeckShield previously flagged suspicious outflows of more than $9.7 million across multiple networks. The assets were reportedly swapped, bridged to Ethereum, and consolidated into roughly 5,227 ETH in a single address.

The company said it remains well capitalized and can meet all liabilities. It will absorb the financial impact through its treasury reserves rather than passing losses to clients.

Triple-A is working with internal and external cybersecurity specialists, blockchain forensics firms, and the Singapore Police Force. The investigation will focus on tracing the assets, identifying the attack vector, and supporting possible recovery efforts.

The next key updates will be the confirmed loss total, the technical cause of the breach, and whether investigators can freeze or recover any of the transferred funds.