On-chain investigator Specter has reported that losses tied to compromised hot wallets associated with Singapore payments firm Triple-A have risen further, reaching an estimated $11.8 million. This marks an increase from the more than $9.3 million initially identified late Friday. Specter first publicly highlighted the activity on Friday evening, observing ongoing outflows across several networks including TRON, Ethereum, TON, and Solana.
At that point, the stolen assets had already been swapped and moved via bridges onto Ethereum, where they were consolidating at a primary address.
Additional related addresses on various chains were also noted.
The researcher indicated that the team appeared unaware, as deposit functionality remained active and incoming funds continued to be emptied.
A subsequent update early Sunday detailed that roughly another $1.8 million had been removed, expanding the affected networks to include Bitcoin alongside further activity on TRON.
Specter emphasized that new deposits were still landing in the impacted wallets and being drained more than 31 hours after the first significant outflows.
31 hours after pic.twitter.com/W04XoRrldv
— Specter (@SpecterAnalyst) July 26, 2026
Bitcoin had not featured in the initial reports covering Ethereum, TRON, Polygon, Arbitrum, Solana, and The Open Network.Earlier amplification by security firm PeckShield had adjusted the figure upward to exceed $9.7 million, with visuals showing the main Ethereum consolidation address holding around 5,227 ETH at the time—valued near $9.7 million—following multiple inbound transfers over several hours.
Triple-A publicly acknowledged the reports on Saturday, stating it was actively investigating and would provide a formal update when ready.
The company confirmed that customer funds were not impacted. No further details on the method of access or the nature of the wallets involved have been released as of the latest observations.
Deposits into the affected addresses had not been disabled at the time of Specter’s Sunday assessment.
Triple-A operates as a licensed major payment institution under Singapore’s Monetary Authority, facilitating stablecoin payments that settle in local currencies for merchants.
Its European operations hold relevant licenses in France, with additional registrations in the United States and Canada.
Regulatory requirements in Singapore mandate safeguards for customer assets in trust structures and separation from operational holdings.
The firm has maintained that the drained wallets did not hold customer assets.
This incident occurs amid a series of notable security events in the crypto space during the same period, including separate multimillion-dollar losses at other protocols and bridges. Specter’s monitoring underscores the persistence of the drain even after public alerts, highlighting challenges in rapidly securing multi-chain hot wallet infrastructure used for payment processing.