Payment protocol Triple-A lost more than $9.7 million after an attacker drained its wallets across four blockchains, according to on-chain alerts from blockchain security firm PeckShield. The compromised assets span TRON, Ethereum, Polygon and Arbitrum, and the final figure could exceed the initial estimate.

On-chain records show the exploiter bridged the stolen funds to Ethereum, following a pattern seen in most recent cross-chain thefts. The assets have been consolidated into a single address holding 5,227 ETH, worth approximately $9.696 million at current valuations. PeckShield flagged the bridge on Arbitrum as the component most frequently involved in comparable incidents.

Operator has not acknowledged the incident

Triple-A, a Singapore-based payments protocol that enables businesses to send and receive funds globally, had not publicly acknowledged the attack at the time of reporting. Deposits remained live and new funds continued to flow into compromised infrastructure, a signature of a hot wallet custody failure rather than a smart contract exploit.

Users criticized the team's silence on social channels, with some speculating that the actor could be an insider or developer rather than an external hacker. No evidence has surfaced to support that theory.

The operational consequences are direct. A payments processor that cannot secure its treasury wallets faces immediate counterparty risk: merchants routing settlements through Triple-A infrastructure may have funds exposed until the firm suspends deposits, rotates keys and publishes a post-mortem. Every hour the deposit flow remains open extends the potential loss.

A heavy week for exploits

The Triple-A incident lands two days after three separate exploits hit the sector in a single day: BSquared Network, AFX Trade and the Verus-Ethereum bridge. Combined with Triple-A, the week's hacked total has reached $41.83 million, according to DeFiLlama data.

The monthly picture is worse. Crypto protocols have lost roughly $106 million to hacks in July, with six days still remaining in the month. Bonzo Lend leads the weekly tally at approximately $10.05 million lost.

Zooming out, the past 90 days have seen $264 million extracted across 94 exploits, an average of $2.90 million per day. The pace of incidents appears to be accelerating, a trend that security researchers have linked in part to increasingly capable tooling available to attackers.

For institutional counterparties, the cumulative numbers carry a structural implication. Payment processors and bridge operators remain the weakest links in the custody chain, and the concentration of losses in hot wallet infrastructure suggests the sector's operational security has not kept pace with its balance-sheet growth.

Recovery outcomes remain mixed. Some exploited protocols have negotiated partial returns, but most institutions hit this month are counting full losses.

Unless Triple-A suspends deposits and discloses the breach scope in short order, the firm faces escalating liability exposure from merchants whose funds may still be entering compromised wallets. The next 48 hours will likely determine whether the $9.7 million figure holds or grows.