Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
ETH Triple-A's July vault theft: Attackers transferred approximately US$12.4 million in ETH to Tornado Cash
According to blockchain security company Salus, the attacker who carried out the attack in Triple-A's July vault theft has transferred approximately US$12.4 million worth of ETH to Tornado Cash, a currency mixer.
Funding flow and tracking details
Salus pointed out that a total of 56 deposits entered Tornado Cash on October 9. Through its Tornado monitoring system, the security agency traced 49 large deposits of 100 ETH each and seven small deposits of 10 ETH each, all linked to Triple-A attackers.
Transaction records show that the attacker merged funds flows from two intermediate addresses through a single wallet before depositing funds in Tornado Cash. Salus said one of the funds streams included funds previously withdrawn from the currency mixer. These deposits totaled approximately US$12.4 million.
According to Salus's tracking account records, the transfer occurred after the attacker transferred assets across the chain to Ethereum on September 6, exchanged tokens and spread the funds to two addresses. The attacker then routed the two flows to the same address and ultimately deposited them in Tornado Cash.
Triple-A's official response and losses
Triple-A said that the breaches in July only affected the company's treasury assets, and client funds were not affected. The company estimates the stolen assets at approximately $11.8 million.
In a July 27 statement, Triple-A confirmed unauthorized wallet access and said the financial impact would be absorbed through its treasury reserves. The company pointed out that the affected wallets belonged to its Singapore entity, Triple A Technologies Pte. Ltd.”，No other corporate entities or operations were affected. After completing security inspections, trading and settlement in all markets have returned to normal.
Regarding the financial situation, Triple-A emphasized: "Triple-A has sufficient capital and can fulfill all debt obligations." The company also stated that client funds are placed separately in trust accounts maintained by custodians. Since the company does not provide digital asset custody services on behalf of clients, these accounts are not exposed to risks.
Attack Methods and Social Engineering
Triple-A pointed out in an incident review report released on August 21 that the attack started with a social engineering attack against an engineer. Attackers gain trust by impersonating identities, communicating across channels, and making real-time calls.
After stealing credentials, the attacker gained advanced system privileges, deployed malware, accessed production databases, and abused API credentials to perform cryptocurrency withdrawal operations. The affected operating wallets are distributed across networks such as TRON, Ethereum, Polygon and Arbitrum.
为确保客户资金安全，Triple-A指出客户资金存放于包括星展银行（DBS）和渣打银行（Standard Chartered）在内的机构管理的独立信托账户中。为配合调查，Triple-A聘请了Sygnia进行取证工作并加强安全控制，zeroShadow负责资产追踪及协助追回工作。公司已在发现事件后立即通知了新加坡金融管理局和新加坡警方。
报告指出，补救措施包括收紧访问和审批要求、限制凭证权限、隔离运营环境、扩大监控范围以及审查钱包暴露限额。Triple-A表示，已移除攻击者的活跃访问权限并消除了持久化机制，目前的追踪及潜在冻结行动仍在进行中。
Tornado Cash制裁解除与相关司法进展
值得注意的是，美国财政部于2025年3月解除了对Tornado Cash的制裁，撤销了2022年8月实施的指定。财政部在公告中表示，这一决定是基于对涉及金融制裁的法律和政策问题以及技术演变的审查。尽管如此，部门仍表示将继续监控可能使网络恶意行为者或朝鲜受益的交易。
此外，据报道，美国法官凯瑟琳·波尔·法伊拉（Katherine Polk Failla）因辩护方提出日程冲突及 pending 的无罪判决动议，于8月26日下令将Tornado Cash联合创始人Roman Storm的再审推迟至2027年4月26日。Storm的首次陪审团在2025年8月裁定其犯有串谋经营无证货币传输业务的罪名，但在洗钱和串谋违反制裁罪上未能达成一致。根据修订后的时间表，最终庭前会议定于2027年4月20日举行，即再审前六天。
