Onchain investigator Specter first reported the incident. According to a Peckshield alert published Saturday, wallets tied to Triple-A, a Singapore-based fiat-to-crypto payment gateway, had been drained of funds across Ethereum, Tron, Polygon, Arbitrum, Solana and The Open Network (TON).

Triple-A operates payment infrastructure that lets merchants accept cryptocurrency and settle in fiat currency, meaning its hot wallets hold a rotating pool of customer funds and liquid stablecoins to process transactions quickly. Hot wallets stay connected to the internet for speed, a tradeoff that makes them more exposed than offline cold storage.

Onchain data reviewed by security researchers shows the attacker swapped stolen stablecoins and other liquid assets on decentralized exchanges before bridging the proceeds to Ethereum. The funds landed in a single address beginning with 0x01F8, which held roughly 5,227 ETH, worth about $9.7 million, as of Saturday.

Image source: X

The consolidated wallet received the stolen assets in several tranches rather than one lump transfer, a move that is in line with nefarious actors of the past involved with methodically converting assets across multiple chains before regrouping them.

Lastly, it bears mentioning that Peckshield has flagged similar bridge-to-Ethereum consolidation before, including a suspected exploit that saw $5.25 million bridged from Hedera to Ethereum just a couple of weeks ago.

Triple-A joins a growing list of crypto payment processors and exchanges targeted for hot wallet compromises this year. Attacks on Web3 infrastructure firms often follow a similar arc, i.e., attackers gain access to a hot wallet’s private keys or a misconfigured smart contract, drain liquid assets quickly, then launder proceeds through decentralized exchanges (DEXs) and cross-chain bridges before centralized platforms can freeze funds.

A mirror identical playbook was witnessed when the Gravity Bridge was drained of $5.4 million in May, with the attacker routing stolen funds through Binance to obscure the trail. Not only that, the cybersecurity giant has found that the industry lost $75.87 million to 40 separate hacks just in June alone, a 7.13% drop from May’s $81.7 million (with hot wallet compromises remaining among the most common attack vectors alongside smart contract bugs and private key leaks).

More than eight hours after the breach was first flagged, Triple-A is yet to issue an official statement acknowledging the exploit or detailing what customer funds, if any, were affected. The silence leaves open questions about whether merchants using Triple-A’s payment rails experienced any disruption to settlement, and whether the company holds reserves sufficient to make affected users whole.

Over the coming few hours, security researchers will likely continue tracking the consolidated Ethereum address for signs that the attacker moves funds toward centralized exchanges or a mixing service, a step that could offer investigators a chance to flag the wallet before proceeds are cashed out.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。