Triple-A's hack losses have risen to $11.8 million, as investigations continue into the breach affecting multiple networks.
The losses from the security breach at payment service Triple-A have escalated to $11.8 million, according to the blockchain researcher Specter.
31 hours after pic.twitter.com/W04XoRrldv
— Specter (@SpecterAnalyst) July 26, 2026
The incident, which occurred on July 24, involved the compromise of the project's hot wallets, with initial reports indicating approximately $9.3 million was stolen and moved to the Ethereum network. PeckShield later reported a slightly higher theft estimate of $9.7 million.
— PeckShieldAlert (@PeckShieldAlert) July 25, 2026
On July 26, Specter noted that an additional $1.8 million was withdrawn via Bitcoin and TRON, a network not initially linked to the breach, which had previously only mentioned Ethereum and other blockchains.
The hacker has centralised the stolen assets into a single Ethereum address, which has reportedly received 5,226.67 ETH (valued at about $9.73 million) through multiple transfers, the largest being around 4,140 ETH.
In response to the breach, the Triple-A team confirmed unauthorized access to their treasury wallets and temporarily halted operations for approximately three hours to address the situation. They assured users that their funds remained secure in trust accounts with third-party custodians. While the exact losses were not specified, the company indicated that they would cover the theft from reserves, emphasizing that affected accounts were operational accounts only. An investigation is currently underway involving cyber experts and the Singapore police.
WEMIX Hack Reported
On July 26, a separate hacking incident affecting the WEMIX$ stablecoin resulted in losses amounting to $724,000. The attacker illegally issued around 5.23 million stablecoins, converting them into 30,736 WEMIX and 724,198 USDC.e, subsequently transferring the stolen assets to Ethereum and BNB Smart Chain.
WEMIX confirmed some of the stolen funds reached centralized exchanges and has requested that exchanges and stablecoin issuers freeze the hacker's wallets, with some already taking action against related addresses.
As a precaution, WEMIX suspended all bridge operations within its network while investigating the incident, which is still ongoing.
Garden Finance Exploit
Concurrently, Blockaid reported an exploit on the Garden Finance cross-chain protocol, which paused its operations following alerts. The attacker drained around $450,000 in USDT from Garden's HTLC contracts across multiple networks, including Ethereum and BNB Smart Chain.
🚨 Blockaid detected an ongoing exploit on @gardenfi HTLC.
~$450k USDT drained so far on Eth, Base, Arb and BSC.
More details in 🧵
— Blockaid (@blockaid_) July 26, 2026
A representative from Garden clarified that the protocol itself and its smart contracts were intact, stating that the exploit involved the off-chain database of an independent solver, which processed fraudulent transaction data that led to unauthorized fund transfers. The team is currently evaluating the full extent of the exploit.
Additionally, on July 23, the AFX Trade exchange had already suspended its bridge operations after witnessing a $24.15 million withdrawal, and developers of the Ethereum bridge Verus reported a hack of $7.54 million on the same day.
