Triple-A's $11.8M Hack: We Followed the ETH On-Chain and It Has Already Left the Wallet Investigators Flagged
Triple-A, a Singapore-regulated stablecoin payments firm that serves thousands of merchants, confirmed on July 27 that it had been drained of about $11.8 million across seven blockchains. The reports settled on one concrete object: an Ethereum consolidation wallet where investigators said roughly 5,227 ETH had been parked. So we read that wallet ourselves. As of today it holds almost nothing, and following its transactions shows exactly where the money went next.
The flagged address, 0x01F83B5d...135253b1, currently holds just 1.62 ETH and has made 8 outgoing transactions. Every one of those eight transfers went to the same new address, moving a combined 5,287 ETH, about $10.1 million, out of the wallet the headlines described as holding the funds. That second address has already emptied itself too. The ETH is not sitting still; it is being moved.
Following the money
| Alias | Address | What the chain shows |
|---|---|---|
| HOP-1 (flagged) | 0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1 | The wallet reports called the consolidation address; now holds 1.62 ETH after 8 outgoing txs |
| HOP-2 | 0x9d358e54f405e120807D7a07B2895cE77Fe7d53D | Received all 5,287 ETH from HOP-1, then dispersed it via 36 more txs; now holds ~0 ETH |
What the numbers say, and what they do not
Two things are solid because we read them from a public Ethereum node. First, the flagged wallet is effectively empty. Second, its funds were consolidated into a single second address in eight transfers and then pushed onward through dozens more, so the ETH leg of this theft is already one hop past the address every outlet cited. What we deliberately do not do is name or allege who is behind it, or state the root cause; the firm has not disclosed whether this was a credential or an infrastructure compromise, and we will not guess.
| Triple-A hack, by the numbers | Figure |
|---|---|
| Reported total loss (third-party estimate) | ~$11.8M |
| Chains affected (reported) | 7 |
| ETH swept out of the flagged wallet (verified) | 5,287 ETH |
| That ETH in USD (at $1,912) | ~$10.1M |
| Balance left in either consolidation wallet | ~1.6 ETH |
Why the escalating dollar figure matters
The reported loss climbed over three days, from about $9.3 million to $9.7 million to $11.8 million, as blockchain-security firms revised their estimates and the drain continued across chains. That pattern, a number that keeps rising after the first alert, is itself a signal: it means the sweep was still in progress when the first reports landed, which fits what the ETH wallet shows, funds being consolidated and moved rather than frozen. The on-chain read is the antidote to the moving headline: instead of a dollar figure that changes by the hour, you get a fixed fact, this specific wallet held X and now holds almost nothing.
The regulated-firm angle
Triple-A is not an anonymous DeFi protocol; it is a licensed payments company operating under Singapore's regulatory regime, which is why this lands harder than a typical exploit. The firm has indicated that segregated client funds were not affected, a distinction that matters and that we are not disputing, the loss described is to its own treasury and hot-wallet infrastructure. But a licensed institution being drained across seven chains, with the proceeds already moving, is exactly the kind of incident that draws regulators and raises the bar on how payment firms custody crypto.
The bottom line
The headline number for the Triple-A hack is $11.8 million and it may yet move again. The fixed fact we can offer is on-chain: the ETH the reports located has already been swept to a second wallet in eight transfers and pushed onward through dozens more, and both addresses now sit near zero. When funds move this fast, the window for a freeze is narrow, and the story shifts from how much was taken to how quickly it can be followed.
Data note. DEXTools News read the balances and transaction counts of the two addresses from a public Ethereum node on July 28, 2026: the flagged wallet 0x01F83B5d...135253b1 (1.62 ETH, 8 outgoing txs) and 0x9d358e...7Fe7d53D (received 5,287 ETH, now ~0 after 36 outgoing txs), valued at the live ETH price of $1,912. Balances are a point-in-time snapshot and may change. The ~$11.8M total, the seven-chain scope, the escalating loss estimates and the segregated-funds statement reflect PeckShield/Specter analysis and Triple-A statements. We make no claim about the attacker's identity or the root cause. This is information, not financial advice.
Frequently asked questions
How much was stolen in the Triple-A hack?
Blockchain-security firms estimated the loss at about $11.8 million across seven chains, a figure that climbed from ~$9.3M to ~$9.7M to ~$11.8M over three days as the drain continued. DEXTools News independently verified that 5,287 ETH (about $10.1M at $1,912) was swept out of the flagged Ethereum consolidation wallet. Triple-A has indicated segregated client funds were not affected.
Where did the stolen Triple-A ETH go?
Reading the flagged wallet 0x01F83B5d...135253b1 on July 28, it holds just 1.62 ETH after eight outgoing transactions. All eight went to a single new address, 0x9d358e...7Fe7d53D, moving a combined 5,287 ETH. That second address then dispersed the funds through 36 further transactions and now also holds roughly zero, so the ETH is already two hops past the wallet outlets cited.
Who was behind the Triple-A hack?
DEXTools News does not name or allege an attacker. Triple-A has not disclosed whether the breach was a credential or an infrastructure compromise, so the root cause is unconfirmed. What is verifiable on-chain is the movement of funds, not the identity or method behind it.
Why does an on-chain read matter when the loss figure keeps changing?
The reported dollar total rose over several days as estimators revised it and the sweep continued. Reading the wallet directly gives a fixed fact instead of a moving headline: this specific address held the funds and now holds almost nothing. It also shows the money is being actively moved, which narrows the window for any freeze.