Triple-A verified a treasury-wallet breach Monday. Hackers stole digital assets over the weekend. On Saturday, July 25, the stablecoin firm flagged unauthorized access deep inside its systems. Executives confirmed the cyberattack two days later. And the financial damage strictly impacts their own operational reserves.
Customer funds survived.
Triple-A doesn’t offer direct custody. Trust accounts managed by external institutions hold all retail capital. The firewall physically separated retail money from the compromised network. To secure operations, executives pushed several global services into maintenance mode. Settlements are now processing at normal speeds.
Executives refused to disclose the exact loss or explain the exploit mechanics. To be fair, independent investigators quickly filled the void. Specter—an on-chain researcher—initially pegged the theft at $9.3 million. Soon after, he uncovered additional unauthorized transfers. The hackers systematically drained wallets across the TRON, TON, Ethereum, and Solana networks. Those combined losses reached an estimated $11.8 million.
PeckShield publicly validated that analysis. The cybercriminals swapped the stolen assets and bridged them over to Ethereum. Right now, they’re consolidating those funds there. Triple-A insists the financial hit only affects specific operational accounts.
Corporate reserves will absorb the entire loss. Management insists the firm remains highly capitalized and can meet all current liabilities. According to company statements, cybersecurity specialists and the Singapore Police Force are actively investigating the incident. Just hours prior, the BitMart Exchange shut down entirely after its native token crashed. But Triple-A claims its payment network is functioning perfectly. Authorities still need to figure out exactly what the hackers were looking for.
Treasury Setup Shields Retail Accounts
Triple-A dodged a liquidity crisis because it refuses to custody retail capital directly. Hackers breached the perimeter, yet they could only access corporate money.
So retail investors face zero exposure to the exploit. Triple-A didn’t commingle its operational capital with customer deposits. If they had, an $11.8 million theft could have triggered a bank run. Instead, the firm internalized the damage. The immediate involvement of the Singapore Police Force signals a strict policing approach to blockchain tracing. Investigators can track the stolen funds. Meanwhile, the payment network continues to process routine settlements.