Triple-A hot wallet drained for $9.7 million across multiple chains
Security & Exploits ·
The stablecoin payment processor lost $9.7 million after attackers breached a hot wallet and moved funds across several blockchains.
The exploit was flagged by PeckShieldAlert, which reported the $9.7 million figure tied to the Triple-A incident. Corroborating detail from the same cluster indicates the attacker consolidated the stolen funds into 5,227 ETH, a step commonly used to simplify laundering or bridging proceeds after a multi-chain theft.
Triple-A operates as a stablecoin processor, meaning it handles routing and settlement of stablecoin payments for downstream users or merchants. A breach of its hot wallet — the internet-connected wallet used for active, day-to-day transaction flow rather than cold, offline storage — points to a compromise of the operational infrastructure that keeps funds readily accessible for processing, which is also what makes such wallets a persistent target for attackers.
The incident lands amid broader scrutiny of wallet security across the industry. A separate explainer on wallet mechanics notes that a crypto wallet is fundamentally a key-management tool rather than a literal container of funds, and that hot wallets connected to applications and services carry elevated exposure to malware, approval exploits, and infrastructure compromise. That same coverage universe includes an unrelated incident in which Zerion shut down its web app after detecting suspicious activity, though it confirmed user funds remained safe there — a contrast to the confirmed loss in the Triple-A case.
Two distinct sources have covered the Triple-A drain so far, converging on the $9.7 million figure and the multi-chain nature of the attack. Not yet disclosed is the specific vulnerability that allowed access to the hot wallet, whether any funds have been frozen or recovered, and what exposure, if any, Triple-A’s merchant or user base faces as a result.
What remains to be seen is whether Triple-A issues a formal post-mortem identifying the attack vector, and whether the consolidated 5,227 ETH shows further movement that could aid tracing efforts.