What happened
On July 25, 2026, Triple-A identified unauthorized access to operational wallets holding its own treasury assets. Triple-A's postmortem says a social-engineering attack compromised an engineering-team member's credentials, then escalated privileges and deployed malware to access production systems and execute unauthorized withdrawals. Client funds were not affected because they were held separately in trust accounts; the company absorbed the treasury loss from reserves.
How it happened
- Attackers used multi-channel social engineering and impersonation to compromise credentials associated with a Triple-A engineering-team member.
- They gained access to an operational environment, escalated privileges, and deployed malware.
- The attackers accessed production databases, abused legitimate API credentials, and executed unauthorized cryptocurrency withdrawals from operational wallets.
- Triple-A contained the incident, temporarily placed some services in maintenance mode, and restored services within about three hours.
- On-chain reporting later estimated the loss at about $11.8 million as additional deposits were swept from affected wallets.
Protocol details
Classification
Other / Key Compromise
Protocol Type
Exploit/Access control
Implementation language
Solidity
Protocol links
Website
@TripleAHQ
Evidence
- report @TripleAHQ incident report x.com
- report @PeckShieldAlert incident report x.com
- report Triple-A Security Incident: Post-Mortem triple-a.io
- report Triple-A hot wallet losses climb to $11.8 million as new deposits keep being swept: report theblock.co
- analysis DeFiLlama defillama.com
- analysis Official Statement Regarding Recent Wallet Activity triple-a.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
