{
 "tag": "treasury",
 "name": "Treasury",
 "group": "Other",
 "incidents": [
  {
   "slug": "triple-a-hot-wallets-drained-jul-2026",
   "title": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON",
   "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026",
   "json": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "solana",
    "ethereum",
    "tron"
   ],
   "method": null,
   "product": "Triple-A payment processor hot wallets",
   "tags": [
    "solana",
    "ethereum",
    "tron",
    "payments",
    "hot-wallet",
    "treasury",
    "triple-a",
    "multi-chain",
    "peckshield"
   ],
   "amountUsd": 9700000,
   "victims": null,
   "startedAt": "2026-07-24",
   "closedAt": null,
   "updatedAt": "2026-07-25T12:00:00Z",
   "summary": "On Jul 24, 2026, on-chain analyst Specter flagged suspicious outflows from hot wallets of the crypto payment processor Triple-A, and PeckShield later estimated losses above $9.7 million. crypto.news lists Ethereum, Solana, TRON and TON as affected, with some reports adding Polygon and Arbitrum. The proceeds were gathered in an Ethereum address holding about 5,227 ETH. The cause had not been disclosed, and no evidence tied the breach to Triple-A's custody provider Fireblocks. Merchants and customers should rely only on Triple-A's official channels for updates."
  },
  {
   "slug": "step-finance-treasury-drain-jan-2026",
   "title": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down",
   "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026",
   "json": "https://drains.watch/i/step-finance-treasury-drain-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "key-leak",
   "product": "Step Finance treasury and fee wallets",
   "tags": [
    "solana",
    "key-leak",
    "treasury",
    "team-wallet",
    "private-key",
    "step-finance",
    "solanafloor",
    "remora",
    "staking"
   ],
   "amountUsd": 40000000,
   "victims": null,
   "startedAt": "2026-01-31",
   "closedAt": "2026-01-31",
   "updatedAt": "2026-02-23T12:00:00Z",
   "summary": "On Jan 31, 2026, Step Finance reported a breach of some of its treasury wallets. CertiK saw 261,854 SOL (about $27 million) unstaked and transferred, and Step later put the total near $40 million. SlowMist's hack database classifies the cause as a private key leak. Step, SolanaFloor and Remora Markets announced a wind-down on Feb 23, 2026, with a STEP buyback based on a pre-hack snapshot and a USDC redemption process for Remora rToken holders. Holders should use only official Step channels for the buyback and redemption."
  },
  {
   "slug": "meteora-fake-otc-escrow-1-5m-jan-2026",
   "title": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam",
   "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026",
   "json": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "social-engineering",
   "product": "Meteora treasury (OTC buyback of MET)",
   "tags": [
    "solana",
    "social-engineering",
    "otc",
    "escrow",
    "impersonation",
    "treasury",
    "meteora",
    "usdc"
   ],
   "amountUsd": 1500000,
   "victims": 1,
   "startedAt": "2026-01-17",
   "closedAt": "2026-01-17",
   "updatedAt": "2026-04-30T12:00:00Z",
   "summary": "On Jan 17, 2026, the Solana DEX Meteora sent $1.5 million in USDC to what it believed was a trusted escrow wallet for an OTC buyback of its MET token. Scammers had impersonated the seller to Meteora and Meteora to the seller, so the 'escrow' address was theirs. The funds were reportedly moved through KuCoin. No smart contract was exploited and no user funds were involved. Meteora disclosed the loss in its Q1 2026 token holder report. Teams doing OTC deals should confirm counterparties and escrow addresses over a separate, known channel."
  }
 ],
 "changes": [
  {
   "incident": "triple-a-hot-wallets-drained-jul-2026",
   "incidentTitle": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-07-25",
   "title": "PeckShield amplified the alert as estimates rose above $9.7M; Triple-A had not yet confirmed the breach.",
   "sourceUrl": "https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/",
   "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026"
  },
  {
   "incident": "triple-a-hot-wallets-drained-jul-2026",
   "incidentTitle": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-07-24",
   "title": "Analyst Specter flagged suspicious transfers from Triple-A hot wallets, first estimated at over $9.3M.",
   "sourceUrl": "https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/",
   "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026"
  },
  {
   "incident": "meteora-fake-otc-escrow-1-5m-jan-2026",
   "incidentTitle": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-30",
   "title": "OurCryptoTalk reported the loss, disclosed in Meteora's Q1 2026 Token Holder Report, with the USDC moved through KuCoin and recovery considered unlikely.",
   "sourceUrl": "https://ourcryptotalk.com/news/meteora-otc-scam-1-5m-usdc-loss",
   "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026"
  },
  {
   "incident": "step-finance-treasury-drain-jan-2026",
   "incidentTitle": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-02-23",
   "title": "Step Finance said it would end operations along with SolanaFloor and Remora Markets after the roughly $40M loss.",
   "sourceUrl": "https://www.theblock.co/post/390964/step-finance-shuts-down",
   "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026"
  },
  {
   "incident": "step-finance-treasury-drain-jan-2026",
   "incidentTitle": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-31",
   "title": "Step Finance reported a breach of some treasury wallets; CertiK reported 261,854 SOL (about $27M) unstaked and transferred.",
   "sourceUrl": "https://cointelegraph.com/news/step-finance-solanafloor-remora-markets-wind-down-operations",
   "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026"
  },
  {
   "incident": "meteora-fake-otc-escrow-1-5m-jan-2026",
   "incidentTitle": "Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-17",
   "title": "Meteora sent $1.5M USDC to a scammer-controlled 'escrow' address during an attempted OTC buyback of MET; SlowMist logs it as social engineering.",
   "sourceUrl": "https://hacked.slowmist.io/?c=Solana",
   "url": "https://drains.watch/i/meteora-fake-otc-escrow-1-5m-jan-2026"
  }
 ]
}