# Triple A

Date:: 2026-07-24

Time:: 19:31

Amount:: $12,000,000

Tags:: 🍆 / Dangerous Interview / GraphAlgo

G:: 614704

S:: 


---

## Details


> There appears to be suspicious fund movements from a TRIPLE-A hot wallet on TRON and Ethereum 

> So far, more than $9M+ drained and currently sitting on Ethereum.

> Related addresses:

> 0x8335D258438E47Cd8EB1532C04Cfe445E011aEf6

> TRSr81kTZAL2zMoWBsjE4QBc9B4v8WpSkw

- Source: https://t.me/specterinvestigation/218 




> There appears to be suspicious fund movements from a TRIPLE-A...

> 31 hours after Triple-A wallets first showed massive suspicious outflows, new deposits are still coming in and being drained.

> An additional $1.8M has now been drained across the Bitcoin and TRON networks.

> Addresses:

> 0x2d9E17Abd7fb0A5d0c429142c52C91F9272dc451

> 0x20f774Ae0C053CBc4fB12da30B0e15fcf02de245

> The total loss has now reached $11.8M

> Meanwhile, this was Triple-A's response: "We confirm that customers' funds are not impacted."

> Stay smart.

- Source: https://t.me/specterinvestigation/220 



> On 25 July 2026, Triple-A identified unauthorized access to certain wallets containing the company’s own digital assets.

> Client funds were not affected. Triple-A does not provide digital assets custody on behalf of its clients, and client funds are held separately in trust accounts maintained with safeguarding institutions that were not exposed.

> As a precaution, certain services were temporarily placed into maintenance mode for approximately three hours while we secured the affected infrastructure and completed security checks. All services have since been restored, and transactions and settlements are processing normally across all markets.

> The incident affected only Triple-A’s own treasury assets. Triple-A remains well capitalised, is able to meet all its liabilities and continues to operate globally at normal service levels. The financial impact is limited to specific operational accounts and is being fully absorbed from Triple-A’s treasury reserves.

> We are working with internal and external cybersecurity experts, blockchain forensics specialists and the relevant authorities, including the Singapore Police Force, to investigate the incident, trace the affected assets and support recovery efforts.

> Clients with questions should contact their dedicated account manager or email support@triple-a.io.

- Source: https://x.com/TripleAHQ/status/2081622020932948328





## Onchain

- 0x8195d3496305d2dbe43b21d51e6cc77b6c9c8364 - Victim

- 0x8335D258438E47Cd8EB1532C04Cfe445E011aEf6 - Direct Theft
- 0x2d9E17Abd7fb0A5d0c429142c52C91F9272dc451 - Direct Theft
- 0x20f774Ae0C053CBc4fB12da30B0e15fcf02de245 - Direct Theft
- 0x9a28573c8c29ceedcf4193769fac01775b2c946a - Direct Theft
- 0x924db69d69f275695e97796ff763df294529207b - Direct Theft
- 0x903968a292c6127bb4d6e20d263569bb7792e16f - Direct Theft
- 0xae78790a6639d202594273efdb74ba511d7dbc05 - Direct Theft
- TRSr81kTZAL2zMoWBsjE4QBc9B4v8WpSkw - Direct Theft

- 0x9a28573c8c29ceedcf4193769fac01775b2c946a - Theft / Intermediary
- 0xf50166a97bb4766af9ba21695170989b25d330b6 - Theft / Intermediary
- 0x7ed3a4b16b7d5de9f5d44e29787b045f9ff368b3 - Theft / Intermediary
- 0x573c642ae1cef32627be099810fbcfa44892bb87 - Theft / Intermediary
- 0xf227a340dc7b1cedea98e8efd9665a7db2da2a8d - Theft / Intermediary
- 0x15cb70873bb183030617cae04bf32390e402dc6f - Theft / Intermediary / Swapper 
- 0x9e4bb27b18943faa7e644b6a841f4d8855996887 - Theft / Intermediary / Swapper 
- 0x9d358e54f405e120807d7a07b2895ce77fe7d53d - Theft / Intermediary / Swapper 
- 0xaed30575aefebdeaed62992084984227ac77b183 - Theft / Intermediary / Swapper
- 0xa8a09c4635c52a562b81564c70f0ed3736b4ba26 - Theft / Intermediary / Swapper
- 0x077ace55cc681e3ee54ce2315e01e1e2f7cfc7f3 - Theft / Intermediary / Bridger


- 0x01f83b5d4fb30e8aa3dac1681b4048d9135253b1 - Theft / Consolidation

- 0x74e0bc6ee927e1d5fb41d15b626064d2c689e530 - Theft / Dust (Overlaps with [Teleswap](./teleswap.md))

- 0x8f425dc7835c8e39f9c36ba03151182038f93f3d - Theft / from Tornado Cash 2026-04-28 (Overlaps with ??????)

- 0x33dfbc8b52596ecc7d2057f6b1dad88af8cbde82 - Theft / to Tornado Cash 2026-08-06 (26x100 + 2x10)

- 0xd432925ec435823ef16c3ba5bb9d3e33d6e1a176 - Theft / from Tornado Cash 2026-08-10 (14x100 + 2x10)
- 0x381d88a00216be0913412820fac423aa26874afa - Theft / from Tornado Cash 2026-08-10 (12x100)

- 0xab9d61f554ef34dcd87dac9be889b6f7f7e2c407 - Theft / Laundry / from Tornado Cash 2026-08-10
- 0xcfbfd0cf85fa85a936644ead57f7965d032a820f - Theft / Laundry / from Tornado Cash 2026-08-10
- 0xe09f79cedff0c659c98f520fc09d68f159460481 - Theft / Laundry 
- 0xcd657fbefecfcf93efb6ab87f5c3d712b8fba669 - Theft / Laundry 
- 0x3093e964d3b79ef0cd382ec285c377cbce05719b - Theft / Laundry 
- 0xc0d5039de083928898fcb2d1960b94eca1310c6e - Theft / Laundry 
- 0x31cedba71ef9667845b8ff1cf4096a389c758e1d - Theft / Laundry 

- 0xcfa21036c4b8e50c16671df2801a0b72c7f7165e - Theft / Holding 2026-09-06

- 0xc6bbd4153795118fba7bf1ef0bf4c84b6664901b - Theft / Laundry 2026-09-06 2026-09-11

- 0x0a1308a9e61035bdd0aa26c1298eaef9f6113114 - Theft / to Tornado Cash 2026-09-11 (8x10 + 2x1)