{
 "slug": "triple-a-hot-wallets-drained-jul-2026",
 "title": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON",
 "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026",
 "json": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026.json",
 "status": "live",
 "severity": "critical",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "chains": [
  "solana",
  "ethereum",
  "tron"
 ],
 "method": null,
 "product": "Triple-A payment processor hot wallets",
 "tags": [
  "solana",
  "ethereum",
  "tron",
  "payments",
  "hot-wallet",
  "treasury",
  "triple-a",
  "multi-chain",
  "peckshield"
 ],
 "amountUsd": 9700000,
 "victims": null,
 "startedAt": "2026-07-24",
 "closedAt": null,
 "updatedAt": "2026-07-25T12:00:00Z",
 "summary": "On Jul 24, 2026, on-chain analyst Specter flagged suspicious outflows from hot wallets of the crypto payment processor Triple-A, and PeckShield later estimated losses above $9.7 million. crypto.news lists Ethereum, Solana, TRON and TON as affected, with some reports adding Polygon and Arbitrum. The proceeds were gathered in an Ethereum address holding about 5,227 ETH. The cause had not been disclosed, and no evidence tied the breach to Triple-A's custody provider Fireblocks. Merchants and customers should rely only on Triple-A's official channels for updates.",
 "timeline": [
  {
   "date": "2026-07-24",
   "title": "Analyst Specter flagged suspicious transfers from Triple-A hot wallets, first estimated at over $9.3M.",
   "sourceUrl": "https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/"
  },
  {
   "date": "2026-07-25",
   "title": "PeckShield amplified the alert as estimates rose above $9.7M; Triple-A had not yet confirmed the breach.",
   "sourceUrl": "https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Triple-A hot wallets lose $9.7M in suspected exploit",
   "url": "https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/",
   "publisher": "crypto.news",
   "date": "2026-07-25"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nThe drained funds came from Triple-A's own hot wallets. If you are a merchant or customer using Triple-A, check your account balance and settlement status in the official dashboard.\n\n## What to do now\n- Pause sending new funds to Triple-A deposit addresses until the company confirms its wallets are secure.\n- Get updates only from Triple-A's official site and accounts. Ignore DMs offering refunds or asking you to 're-verify' wallets.\n\n## How to avoid this\n- Don't leave large balances with payment processors; settle out regularly to self-custody or your bank.\n- For businesses: keep hot-wallet balances small, require multi-party approval for large transfers, and alert on unusual outflows across every chain.",
 "notes": null,
 "agentBrief": "# Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON\n\n- Severity: Critical · Status: Partly contained (live)\n- Chains: Solana, Ethereum, Tron\n- Started: Jul 24, 2026 · Last update: Jul 25, 2026 · Reported stolen: $9.7M\n- Who/what: Triple-A payment processor hot wallets\n\nOn Jul 24, 2026, on-chain analyst Specter flagged suspicious outflows from hot wallets of the crypto payment processor Triple-A, and PeckShield later estimated losses above $9.7 million. crypto.news lists Ethereum, Solana, TRON and TON as affected, with some reports adding Polygon and Arbitrum. The proceeds were gathered in an Ethereum address holding about 5,227 ETH. The cause had not been disclosed, and no evidence tied the breach to Triple-A's custody provider Fireblocks. Merchants and customers should rely only on Triple-A's official channels for updates.\n\n## Am I affected?\nThe drained funds came from Triple-A's own hot wallets. If you are a merchant or customer using Triple-A, check your account balance and settlement status in the official dashboard.\n\n## What to do now\n- Pause sending new funds to Triple-A deposit addresses until the company confirms its wallets are secure.\n- Get updates only from Triple-A's official site and accounts. Ignore DMs offering refunds or asking you to 're-verify' wallets.\n\n## How to avoid this\n- Don't leave large balances with payment processors; settle out regularly to self-custody or your bank.\n- For businesses: keep hot-wallet balances small, require multi-party approval for large transfers, and alert on unusual outflows across every chain.\n\n## Sources\n- Triple-A hot wallets lose $9.7M in suspected exploit (crypto.news, 2026-07-25): https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/\n\nFull record: https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026 · JSON: https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}