- Blockchain security firm Salus revealed that the hacker behind the July breach of digital currency payments firm Triple-A transferred roughly $12.4 million in Ether into crypto mixer Tornado Cash.
- The illicit movement followed cross-chain bridging and token swaps, with the attacker routing 4,970 ETH across 56 total transactions on September 6.
- Triple-A previously confirmed its Singapore entity suffered an unauthorized wallet drain via social engineering, maintaining that treasury reserves absorbed the losses without compromising customer funds.
Perpetrator Behind July Triple-A Exploit Funnels Millions Into Tornado Cash
The cybercriminal responsible for the multimillion-dollar breach of digital currency payment gateway Triple-A has moved approximately $12.4 million worth of stolen cryptocurrency into Tornado Cash, according to blockchain security firm Salus. On-chain tracing revealed that the perpetrator executed a series of complex token swaps, bridged assets across networks directly to Ethereum, split the illicit proceeds across two intermediate addresses on September 6, and consolidated the funds prior to depositing them into the mixing protocol.
According to transaction data released by Salus, the exploit actor divided the assets into 56 separate Tornado Cash deposits, comprising 49 transactions containing 100 ETH each (4,900 ETH total) alongside seven smaller deposits totaling 70 ETH. Salus detailed the flow of the digital assets, emphasizing that the hacker routed both streams through a unified address immediately before depositing them into the privacy service. In the post, Salus stated: One stream included funds from earlier withdrawals.
Anatomy of the Triple-A Treasury Compromise
The traceable movement connects directly back to an exploit that targeted Triple-A’s own corporate treasury balances in late July. When unauthorized activity surfaced on July 25, preliminary findings publicized by blockchain investigator Specter and security outfit PeckShield estimated the total stolen sum between $9.3 million and $9.7 million across operational addresses on TRON, Ethereum, Polygon, and Arbitrum, with the destination wallet amassing roughly 5,226.66 ETH. Subsequent analysis by Specter later adjusted the estimated balance of the loss upward to approximately $11.8 million.
Multiliquid Raises $8 Million to Boost Liquidity in $40 Billion Tokenized Asset Market
Triple-A, operated under Triple A Technologies Pte. Ltd. in Singapore, confirmed the security lapse in an official statement on July 27. The company noted that the compromise was confined entirely to its Singapore entity’s operational treasury wallets and required a brief, three-hour service maintenance window to secure core infrastructure. Reassuring partners regarding its ongoing solvency, Triple-A stated: Triple-A remains well capitalised, is able to meet all its liabilities.
The firm emphasized that customer assets were held safely in distinct trust accounts at institutional banking partners, including DBS and Standard Chartered, shielding consumer balances from exposure because the firm does not provide digital asset custody for its clients.
Social Engineering Vector and Incident Remediation
In an August 21 post-mortem disclosure, Triple-A revealed that the attack originated from sophisticated social engineering aimed at an internal engineering employee. The threat actor leveraged multi-channel communications, active impersonation, and a live telephone call to capture corporate credentials. Once authenticated, the attacker elevated administrative permissions, deployed malicious software, tapped production databases, and abused internal API credentials to trigger unauthorized crypto withdrawals.
To mitigate the crisis, Triple-A collaborated with external cybersecurity firm Sygnia for forensic reviews and defense hardening, alongside blockchain tracing firm zeroShadow to support asset-recovery measures. Triple-A reported the cyber incident directly to the Monetary Authority of Singapore and local law enforcement authorities. The payments firm eliminated the attacker’s persistent system access, enacted strict multi-step approval workflows, separated its live operating environments, and narrowed administrative wallet thresholds to prevent future compromises.
Why This Matters
The routing of the stolen Triple-A funds occurs against a backdrop of shifting regulatory and judicial frameworks surrounding privacy protocols. In March 2025, the U.S. Department of the Treasury lifted its August 2022 sanctions designation against Tornado Cash following reviews of technology policy and legal challenges, even as the government affirmed that it continues to track illicit network traffic tied to state-sponsored actors and cybercriminals.
Simultaneously, U.S. legal proceedings involving Tornado Cash co-founder Roman Storm remain in flux. On August 25, U.S. District Judge Katherine Polk Failla granted Storm’s defense request to postpone his retrial until April 26, 2027, citing defense scheduling conflicts and an unresolved motion for judgment of acquittal. Storm’s initial jury trial in August 2025 yielded a conviction for conspiracy to operate an unlicensed money transmitting business, though jurors deadlocked on additional counts of money laundering and sanctions evasion conspiracy. The ongoing movement of compromised assets through Tornado Cash underscores the persistent technical challenge regulated financial intermediaries face when mitigating laundering risks on decentralized networks.
Frequently Asked Questions
Were customer funds affected by the Triple-A hack?
No. Triple-A confirmed that customer funds remained entirely unaffected. The payments provider does not custody digital assets on behalf of clients, and all customer fiat deposits are segregated in dedicated trust accounts with traditional institutions such as DBS and Standard Chartered.
How did the hacker penetrate Triple-A’s internal networks?
The breach stemmed from a targeted social engineering operation aimed at an engineer at Triple-A. The perpetrator combined live phone calls, identity impersonation, and multi-channel messaging to obtain internal credentials, eventually elevating system permissions, launching malware, and exploiting API keys to drain treasury funds.
What is the status of sanctions against Tornado Cash?
The U.S. Treasury officially lifted its sanctions against Tornado Cash in March 2025 following a review of legal challenges and policy determinations, though federal authorities continue active monitoring of the mixer for illicit blockchain transactions.
