Triple-A: Thieves Tricked One Engineer and Took About $11.8M, Now Reportedly Moving Into Zcash

At 21:18 UTC on Friday 24 July 2026, a quarter past ten at night in London and twenty past five in the morning in Singapore, an on-chain investigator who posts as Specter warned on X that someone was emptying the wallets of a payments company called Triple-A. More than $9.3 million had already gone, he wrote, across at least four blockchains, and it was being swapped, moved and gathered in one wallet on Ethereum. He said he had flagged it on Telegram an hour earlier.

Three hours later he posted again. The company did not seem to know, he wrote, because its wallets were still taking deposits, and every new deposit was being drained as it arrived.

Triple-A says it identified "unauthorized access" at about 02:39 GMT on Saturday 25 July, five hours and 21 minutes after that first post on X. By Specter's count the losses reached about $11.8 million. Triple-A, which holds a payments licence from the Monetary Authority of Singapore, the country's central bank and financial regulator, has never published a figure of its own.

On 17 October 2026, almost three months later, Specter posted that money from the Triple-A theft had started flowing into Zcash, a cryptocurrency built to hide who pays whom. It was the same route, he said, already used with money stolen from the exchange Bitget and from buyers of tampered Ledger wallets.

A payments firm, not a bank

Triple-A does for crypto roughly what a card processor such as Worldpay does for card payments. A shop, an airline or a game seller lets customers pay in digital coins, mostly stablecoins, which are digital dollars such as USDT (issued by Tether) and USDC (issued by Circle). Triple-A takes the coins, converts them and pays the merchant in ordinary money. Its chief executive and founder, Eric Barbier, earlier founded TransferTo, the Singapore payments firm whose business-payments arm became Thunes. Triple-A says it serves more than 1,000 business clients.

To do the converting, Triple-A keeps a float of its own coins in "hot" wallets, ones connected to the internet so they can pay out at any moment. A hot wallet is the till at a bureau de change: always open, always stocked, and exactly what a thief goes for.

The licence matters here. Triple A Technologies Pte. Ltd. is listed by the Monetary Authority of Singapore (MAS) as a Major Payment Institution, licence number PS20200525, and Triple-A says it was the first company to receive one covering digital tokens in Singapore, in 2021. Its French arm, Paytop SAS, is licensed by the French regulators ACPR and AMF. In the United States it is registered with FinCEN, the Treasury's financial crimes unit, and in Canada with FINTRAC. On 15 July, nine days before the theft, Dubai's crypto regulator VARA gave it approval in principle to act as a broker-dealer.

How the money left

©CMZ chart. Data: Specter, PeckShield via The Block

The drain hit wallets on several networks at once. Triple-A itself names four: TRON, Ethereum, Polygon and Arbitrum. PeckShield, a blockchain security firm, put the losses at more than $9.7 million and also tracked money moving on Solana and TON, the network linked to the messaging app Telegram. The thief swapped what was taken and used bridges, services that move money from one blockchain to another like a currency exchange booth between two stock markets, to bring it to Ethereum. According to PeckShield, one Ethereum wallet received eight transfers between 20:35 UTC on Friday and 03:03 UTC on Saturday, the largest about 4,140 ether, and ended up holding 5,226.67 ether, about $9.73 million at the time. Ether, Ethereum's own coin, then traded at about $1,860, according to CoinGecko.

On Sunday 26 July, The Block reported, Specter said a further $1.8 million had been taken on Bitcoin and TRON, which brought his total to about $11.8 million. He also said new deposits were still being swept 31 hours after the first large withdrawals. Triple-A has not publicly addressed that claim.

Triple-A explained the break-in four weeks later. In a post-mortem dated 21 August, it said the attack began with social engineering, a con aimed at one member of its engineering team: impersonation, messages across several channels and a live call. Once the attacker had that person's login details, the attacker reached an operational system, obtained higher permissions, installed further malicious software, got into production databases and used the company's own legitimate API credentials, the digital keys that let its software order payments automatically, to withdraw the coins. In office terms, a con artist talked his way into one employee's building pass, then found the room where the standing payment orders are signed.

The company was firm that its code was not the problem. The attack, it said, did not come through a flaw in a smart contract, code that moves money by itself, and "was not a flaw in Triple-A's products or infrastructure". It gave no loss figure, no list of wallets and no breakdown of the coins taken.

The method has been seen this year before. Two days before the Triple-A drain the crypto trading platform AFX Trade lost $24.15 million after a fake recruiter persuaded one of its developers to copy booby-trapped code, which led to five of its signing keys being used against it. In both cases nobody broke the cryptography. Someone talked to a person.

From DAI to Tornado Cash to Zcash

Much of the money sat still at first, which is common. On 6 August Specter reported that the thief had turned DAI, a digital dollar, into 2,620 ether and sent it into Tornado Cash in 28 deposits, about $4.99 million. Tornado Cash is a mixer: everyone pours identical amounts into one shared pot and later takes the same amounts out to fresh wallets, so the link between what went in and what came out is broken, like cash passed through a crowded coat check. About $6.7 million in DAI was still untouched.

On 6 September the remaining funds were bridged to Ethereum, swapped and split between two wallets. On 9 October, according to the blockchain monitor Salus, the attacker gathered them again and pushed 4,970 ether, about $12.4 million, into Tornado Cash in 56 deposits: 49 of 100 ether and seven of 10. The dollar figure is higher than the loss because ether had risen to about $2,500, and Salus said part of the batch was money that had already been through the mixer once.

Then came Zcash. ZEC, its coin, can be sent through a "shielded pool", a part of the network where the sender, the receiver and the amount are all hidden, rather like a share register that records only that a trade happened. On 30 September ZachXBT, a well-known crypto investigator, reported that wallets tied to the Bitget theft had sent about 2,700 ZEC, about $3.8 million, into Ironwood, Zcash's newest shielded pool. On 17 October Specter wrote that since then "we've seen other stolen funds flow into ZEC", including funds from the CryptoBilis Ledger case and the Triple-A hack. "Threat actors are actively using ZEC to move stolen funds," he added.

Specter did not publish transaction details or amounts for the Triple-A transfers, did not show how the ether reached Zcash, and did not claim that one group was behind all three thefts. crypto.news, reporting his post, noted that he had not published a complete transaction trail. Zcash itself has no flaw in this story. The privacy works as designed.

ZEC has also become far more valuable. It traded at about $504 on the day of the Triple-A drain, according to CoinGecko, and at about $1,143 on 17 October, according to CoinGecko figures cited by The Coin Republic. AMBCrypto reported that the amount of ZEC held in shielded pools had risen since July from about 4.3 million to 4.96 million coins.