{"id":75912,"date":"2026-07-25T15:52:35","date_gmt":"2026-07-25T15:52:35","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/triple-a-hot-wallets-drained-of-9-7-million-across-six-chains-heres-what-peckshield-found\/"},"modified":"2026-07-25T15:52:35","modified_gmt":"2026-07-25T15:52:35","slug":"triple-a-hot-wallets-drained-of-9-7-million-across-six-chains-heres-what-peckshield-found","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/triple-a-hot-wallets-drained-of-9-7-million-across-six-chains-heres-what-peckshield-found\/","title":{"rendered":"Triple-A Hot Wallets Drained of $9.7 Million Across Six Chains: Here&#8217;s What Peckshield Found"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Triple-A lost over $9.7 million from hot wallets across six chains, per Peckshield.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">The attacker bridged proceeds to Ethereum, consolidating roughly 5,227 ETH in one address.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Triple-A had issued no public statement more than eight hours after the breach was flagged.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>Onchain Investigator Flags the Breach First<\/h2>\n<p>Onchain investigator Specter first reported the incident. According to a <a href=\"https:\/\/twitter.com\/PeckShieldAlert\/status\/2080833993633866106\" target=\"_blank\" rel=\"noopener noreferrer\">Peckshield alert<\/a> published Saturday, wallets tied to Triple-A, a Singapore-based fiat-to-crypto payment gateway, had been drained of funds across Ethereum, Tron, Polygon, Arbitrum, Solana and The Open Network (TON).<\/p>\n<p>Triple-A operates payment infrastructure that lets merchants accept cryptocurrency and settle in fiat currency, meaning its hot wallets hold a rotating pool of customer funds and liquid stablecoins to process transactions quickly. Hot wallets stay connected to the internet for speed, a tradeoff that makes them more exposed than offline cold storage.<\/p>\n<p>Onchain data reviewed by security researchers shows the attacker swapped stolen stablecoins and other liquid assets on decentralized exchanges before bridging the proceeds to Ethereum. The funds landed in a single address beginning with 0x01F8, which held roughly 5,227 ETH, worth about $9.7 million, as of Saturday.<\/p>\n<figure id=\"attachment_833927\" aria-describedby=\"caption-attachment-833927\" style=\"width:931px\" class=\"wp-caption aligncenter\"><figcaption id=\"caption-attachment-833927\" class=\"wp-caption-text\">Image source: X<\/figcaption><\/figure>\n<p>The consolidated wallet received the stolen assets in several tranches rather than one lump transfer, a move that is in line with nefarious actors of the past involved with methodically converting assets across multiple chains before regrouping them.<\/p>\n<p>Lastly, it bears mentioning that Peckshield has flagged similar bridge-to-Ethereum consolidation before, including a <a href=\"https:\/\/news.bitcoin.com\/peckshield-hedera-exploit-5-25-million-bridged-ethereum\/\">suspected exploit that saw $5.25 million bridged<\/a> from Hedera to Ethereum just a couple of weeks ago.<\/p>\n<h2>A Familiar Pattern for Payment Infrastructure<\/h2>\n<p>Triple-A joins a growing list of crypto payment processors and exchanges targeted for hot wallet compromises this year. Attacks on Web3 infrastructure firms often follow a similar arc, i.e., attackers gain access to a hot wallet\u2019s private keys or a misconfigured smart contract, drain liquid assets quickly, then launder proceeds through decentralized exchanges (DEXs) and cross-chain bridges before centralized platforms can freeze funds.<\/p>\n<p>A mirror identical playbook was witnessed when the <a href=\"https:\/\/news.bitcoin.com\/gravity-bridge-exploit-5-4-million-binance-changenow-2026\/\">Gravity Bridge was drained of $5.4 million<\/a> in May, with the attacker routing stolen funds through Binance to obscure the trail. Not only that, the cybersecurity giant has found that the industry lost <a href=\"https:\/\/www.banklesstimes.com\/articles\/2026\/07\/01\/crypto-hacks-hit-75-9m-in-june-across-40-incidents-peckshield-reports\/\" target=\"_blank\" rel=\"noopener noreferrer\">$75.87 million<\/a> to 40 separate hacks just in June alone, a 7.13% drop from May\u2019s $81.7 million (with hot wallet compromises remaining among the most common attack vectors alongside smart contract bugs and private key leaks).<\/p>\n<h2>No Remedial Measures Taken<\/h2>\n<p>More than eight hours after the breach was first flagged, Triple-A is yet to issue an official statement acknowledging the exploit or detailing what customer funds, if any, were affected. The silence leaves open questions about whether merchants using Triple-A\u2019s payment rails experienced any disruption to settlement, and whether the company holds reserves sufficient to make affected users whole.<\/p>\n<p>Over the coming few hours, security researchers will likely continue tracking the consolidated Ethereum address for signs that the attacker moves funds toward centralized exchanges or a mixing service, a step that could offer investigators a chance to flag the wallet before proceeds are cashed out.<\/p>\n<\/p><\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><a href=\"https:\/\/news.bitcoin.com\/triple-a-hot-wallet-exploit-9-7-million-peckshield\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Triple-A lost over $9.7 million from hot wallets across six chains, per Peckshield. The attacker bridged proceeds to Ethereum, consolidating roughly 5,227 ETH in one address. Triple-A had issued no public statement more than eight hours after the breach was flagged. Onchain Investigator Flags the Breach [&hellip;]<\/p>\n","protected":false},"author":3947362404,"featured_media":75913,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/75912"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/3947362404"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=75912"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/75912\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/75913"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=75912"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=75912"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=75912"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}