For business
KYT office
Compliance solution to monitor risks, detect sanctions and ensure AML rules.
KYT office
Compliance solution to monitor risks, detect sanctions and ensure AML rules.
AML certification
How industry players can get up-to-date knowledge and professional certification.
AML certification
How industry players can get up-to-date knowledge and professional certification.
Comprehensive transaction analytics that helps to build graphs and trace funds.
Graph
Travel rule
(soon)
For personal use
Telegram bot
Bot for checking crypto for risks, providing AML reports.
Telegram bot
Bot for checking crypto for risks, providing AML reports.
Crypto recovery
Services are focused on tracking
and recovering crypto assets.
and recovering crypto assets.
Сrypto recovery
Services are focused on tracking
and recovery crypto assets.
and recovery crypto assets.
Docs and reports
All types of documents related
to cryptocurrency.
to cryptocurrency.
Docs and reports
All types of documents related
to cryptocurrency.
to cryptocurrency.
Portfolio tracker
Information about all assets and risk assessment in one place.
Portfolio tracker
Information about all assets and risk assessment in one place.
AML checks
Сhecking wallets and transactions
for illicit funds.
for illicit funds.
AML checks
Сhecking wallets and transactions
for illicit funds.
for illicit funds.
AML-сертификация
Актуальные знания в области AML/KYT от ведущих экспертов отрасли.
AML-сертификация
Актуальные знания в области AML/KYT от ведущих экспертов отрасли.
Graph
Визуализация перемещения активов
и связей между кошельками.
и связей между кошельками.
Graph
Визуализация перемещения активов
и связей между кошельками.
и связей между кошельками.
KYT Office
Мониторинг транзакций и кошельков для вашего отдела комплаенса.
KYT Office
Мониторинг транзакций и кошельков для вашего отдела комплаенса.
Для себя
Для Бизнеса
Travel rule
(Cкоро)
Телеграм-бот
Бот для проверки кошельков и транзакций с выдачей отчётов.
Телеграм-бот
Бот для проверки кошельков и транзакций с выдачей отчётов.
Возврат средств
Услуги по отслеживанию и возврату украденных криптоактивов.
Возврат средств
Услуги по отслеживанию и возврату украденных криптоактивов.
AML-проверки
Проверка кошельков и транзакций на наличие "грязной" криптовалюты.
AML-проверки
Проверка кошельков и транзакций на наличие "грязной" криптовалюты.
Портфолио трекер
Информация о всех активах и оценка рисков в одном месте.
Портфолио трекер
Информация о всех активах и оценка рисков в одном месте.
Отчёты
Все типы документов связанные
с криптовалютой.
с криптовалютой.
Отчёты
Все типы документов связанные
с криптовалютой.
с криптовалютой.
On July 24–25, 2026, assets worth more than $9 million were withdrawn from wallets publicly associated with the Triple-A crypto project. The transactions were regular signed transfers — as if they had been initiated by the owner themselves. In other words, there was no exploit in the traditional sense.
The most complicated part came afterward: the funds were split across four networks, routed through more than a dozen exchanges and bridges, and eventually consolidated into a single asset on a single address.
BitOK analysts investigated the case. We explain how attackers obtained $9 million so easily and what other crypto projects need to know to avoid becoming the next victim.
The most complicated part came afterward: the funds were split across four networks, routed through more than a dozen exchanges and bridges, and eventually consolidated into a single asset on a single address.
BitOK analysts investigated the case. We explain how attackers obtained $9 million so easily and what other crypto projects need to know to avoid becoming the next victim.
Table of content:
- How More Than $9 Million Was Withdrawn from Triple-A Wallets
- How the Funds Moved
- Timeline
- Key Addresses
- Where the Initial Funds Came From
- Overall Picture
- Lessons From the Incident
How More Than $9 Million Was Withdrawn from Triple-A Wallets
How More Than $9 Million Was Withdrawn from Triple-A Wallets
The attackers did not compromise the code itself. Instead, they compromised the system responsible for managing wallets and signing transactions.
Before diving into the details, let’s clarify two key terms:
Before diving into the details, let’s clarify two key terms:
- Hot wallet — a wallet connected to the internet and used by a service for operational transactions. It is controlled not manually by a person, but by a transaction-signing system.
- Compromise of the wallet management layer — a situation where an attacker gains access to this system or its keys. In that case, there is no need to break a smart contract: transfers appear as ordinary legitimate transactions because they are signed with valid keys.
Notably, the same original address operated across three networks simultaneously — Ethereum, Polygon, and Arbitrum. At the same time, withdrawals were also made from a separate TRON wallet. Such coordinated activity across multiple networks indicates access to a shared wallet management system.
A simple analogy helps explain the incident. Imagine a company with accounts in different banks and countries, where all payments are processed through one system with shared access. An attacker gains access to that system and starts sending transfers on behalf of the company. For the banks, everything appears legitimate: payment instructions are signed with valid keys.
Later, to hide the trail, funds from different banks are routed through exchanges and converted into one currency in a single account. The first step is access to the control panel; the second is obfuscating the route.
Key findings from the Triple-A case:
Later, to hide the trail, funds from different banks are routed through exchanges and converted into one currency in a single account. The first step is access to the control panel; the second is obfuscating the route.
Key findings from the Triple-A case:
- Losses exceeded $9 million.
- The attack was likely caused by a compromise of wallet infrastructure or transaction signing mechanisms, not a code vulnerability.
- Funds from four networks were consolidated through collector wallets, exchanged for ETH through multiple services, and ultimately combined into 5,228.33 ETH on one Ethereum address.
How the Funds Moved
How the Funds Moved
The funds were not sent directly to the final wallet. First, they were split across networks and assets, then routed through exchange and cross-chain services that accepted USDT, USDC, and other tokens and returned ETH on Ethereum.
The full chain consisted of three main branches:
The full chain consisted of three main branches:
- TRON branch. A TRON collector received 6,653,600 USDT across 17 transfers. The funds then moved through Sun.io, deBridge, and service nodes.
- Main EVM branch. The primary EVM collector received approximately 4,972 ETH directly from known service contracts including Chainflip, deBridge, Relay, CoW Protocol, OKX, NEAR Intents, and Across.
- Additional EVM branch. A second collector received 80,408 stablecoins (USDC, USDT, EURC, PYUSD, USDT0) and 2.7 ETH from Ethereum, Polygon, and Arbitrum.
All branches eventually converged on a single Ethereum address. The majority came from the main collector, supplemented by 72 ETH from the second collector and 6.835 ETH from a temporary transfer wallet.
Investigator note: two TRON → Ethereum transfer pairs through deBridge match by timing and value, creating a strong cross-chain correlation.
Timeline
Timeline
Key Addresses
Key Addresses
Where the Initial Funds Came From
Where the Initial Funds Came From
Two separate addresses were used to fund the TRON collector with initial gas. One had previously received funds from a high-volume service address, while the other had a transfer history from the HTX exchange in 2024. However, the two-year gap and mixed wallet activity do not allow us to conclude that an HTX user funded the attack.
On Ethereum, the main collector did not require an external gas source. The first major payment — 533.68 ETH from deBridge — arrived before the first outgoing transaction, meaning subsequent operations were funded from already received assets.
On Ethereum, the main collector did not require an external gas source. The first major payment — 533.68 ETH from deBridge — arrived before the first outgoing transaction, meaning subsequent operations were funded from already received assets.
How the attacker moved the funds. The graph was built using BitOK's Graph tool.
Overall Picture
Overall Picture
The attacker’s main weapon was access to wallet management across multiple networks, not a vulnerability in smart contract code. After gaining access, the attacker performed ordinary signed transfers, distributed assets across TRON, Ethereum, Polygon, and Arbitrum, routed them through numerous exchanges and bridges, converted everything into ETH, and consolidated the funds into one address.
Investigator's Note: Distributing the stolen funds across multiple networks and services is a deliberate tactic designed to make tracing significantly more difficult.
At the time of the investigation snapshot, the final address still held all 5,228.33 ETH. No confirmed outgoing transfers were detected.
Investigator's Note: Distributing the stolen funds across multiple networks and services is a deliberate tactic designed to make tracing significantly more difficult.
At the time of the investigation snapshot, the final address still held all 5,228.33 ETH. No confirmed outgoing transfers were detected.
Lessons From the Incident
Lessons From the Incident
The main lesson is that hot wallet security is only as strong as the system responsible for managing and signing transactions.
- A unified management layer is a single point of failure. Attackers did not need to find a code vulnerability. Transactions were technically valid because they were signed with correct keys.
- Keys and signing processes cannot be compromised. Best practices include storing keys in secure hardware modules (HSMs), using distributed signing with multiple independent participants, avoiding storage on ordinary workstations, and setting alerts for unusual outgoing transfers.
At the time of the investigation, the funds remained visible on a single address and had not moved further. This is positive for the project team, but it does not guarantee recovery. Returning the funds would require cooperation from services involved in the route and, in most cases, legal procedures.
The large number of bridges and exchanges involved makes recovery significantly harder. This is why proactive infrastructure protection is far cheaper than post-incident investigation.
The large number of bridges and exchanges involved makes recovery significantly harder. This is why proactive infrastructure protection is far cheaper than post-incident investigation.
