$9.7M Drained Across Ethereum, Solana, TRON, and TON in Triple-A Exploit

Triple-A, a global fiat-to-crypto payment gateway, has become the latest victim of a multimillion-dollar hack. Blockchain security firm Peckshield reports that more than $9.7 million was drained after attackers drained its hot wallets across Ethereum, Solana, TRON, and TON.

Here’s how the attack happened.

Triple-A Hot Wallets Drained Across Multiple Networks

Peckshield reported that the exploit targeted Triple-A’s hot wallet infrastructure, affecting Ethereum, Solana, TRON, TON, Polygon, and Arbitrum.

According to the investigation, attackers stole over $9.7 million worth of crypto before swapping the assets and bridging them to Ethereum. 

Blockchain records show the wallet currently holds 5,226.66 ETH, worth roughly $9.72 million. 

• Most of the stolen funds were transferred on July 24 and July 25.
• The largest single transaction moved 4,140 ETH into the wallet.
• Additional deposits included 615 ETH, 157 ETH, 112 ETH, 100 ETH, 72 ETH, and 23 ETH.

After receiving these transfers, the attacker consolidated the funds into a single Ethereum wallet (0x01F…253b1).

How the Triple-A Exploit Happened?

Security researchers believe the attacker first gained control of Triple-A’s internet connected hot wallets, which are commonly used to process customer payments quickly.

After gaining access, the hacker focused on stealing stablecoins and other liquid assets, then rapidly swapped them on decentralized exchanges. 

#PeckShieldAlert Specter has reported that @TripleAHQ wallets appear to have been drained of more than $9.7M worth of crypto across multiple chains, including #TRON, #Ethereum, #Polygon, and #Arbitrum.

The exploiter bridged the stolen funds to Ethereum. 5,227 $ETH is currently… pic.twitter.com/JxCr79V2db

— PeckShieldAlert (@PeckShieldAlert) July 25, 2026

Meanwhile, the stolen funds were then bridged to Ethereum, making it easier to consolidate the assets into one wallet.

No Official Response Yet

It’s been more than 8 hours, and Triple-A has not released an official statement explaining the incident or confirming the exact cause of the exploit.

Security experts say companies handling large amounts of customer funds should strengthen wallet management, improve private key protection, and reduce the amount of assets kept online to limit future losses.