Triple-A says a $11.8 million hack hit its own crypto treasury, not client funds

Singapore-based Triple-A, which provides stablecoin and crypto payment infrastructure for businesses, said attackers accessed some wallets holding the company’s own digital assets. For high-risk payment operators, the key detail is the segregation claim: Triple-A says client funds were kept on trust accounts and were not compromised.

1. Triple-A put the loss at $11.8 million and said the breach involved unauthorized access to some wallets containing its own crypto assets. The company said it has enough capital to meet all obligations and will cover the loss entirely from its own treasury reserves.
2. As a precaution, Triple-A moved some services into maintenance mode for about three hours. It said all services are now restored and that transactions and settlements are processing normally.
3. Triple-A said its client funds were held separately on trust accounts, which were not compromised. That matters because the company operates a fiat-to-crypto gateway for more than 20,000 merchants, and its hot wallets are used to manage the liquid pool that supports payments.
4. The leak was first spotted by blockchain analyst Specter on X. He said more than $9.3 million was initially drained from Triple-A hot wallets and then converted into Ether; later he said the attacker kept withdrawing funds 31 hours after the first alert, lifting the total loss to $11.8 million.
5. Triple-A said it is working with cybersecurity experts and the Singapore police to track the stolen assets. The company also said the episode does not change its ability to honor obligations to customers.

For PSPs and acquiring teams, the operating question here is not whether a breach happened — it did — but which wallet layer was hit. Triple-A’s line is that the client-money ring fence held, while the company’s own liquidity buffer did not. In this business, that distinction is the whole ballgame.