Triple-A has confirmed that unauthorized access to its treasury wallets resulted in the loss of company-owned digital assets while stating that client funds and payment operations have remained unaffected.

Triple-A said in a statement on Monday that it detected unauthorized access to certain wallets holding its own digital assets on July 25, prompting the company to temporarily place some services into maintenance mode for about three hours while it secured the affected infrastructure and completed additional security checks.

The Singapore-based stablecoin payments company said all services have since been restored and that transactions and settlements are processing normally across all markets. It added that the incident affected only its treasury assets, with the financial impact limited to specific operational accounts that will be fully absorbed through the company’s treasury reserves.

Client assets were not exposed, according to Triple-A, because the company does not provide digital asset custody services on behalf of customers. Instead, it said client funds are held separately in trust accounts maintained with safeguarding institutions that were not affected by the incident.

Triple-A also said it remains well capitalized, can meet all of its liabilities, and continues to operate globally at normal service levels despite the breach.

Company confirms breach after on-chain investigators flagged suspicious activity

The announcement follows reports from blockchain investigators over the weekend that identified unusual transactions involving wallets linked to Triple-A before the company publicly acknowledged the incident.

On-chain investigator Specter initially estimated that more than $9.3 million had been removed from wallets associated with Triple-A before revising the estimate to more than $9.7 million as additional transfers were identified. The investigator later estimated the losses at about $11.8 million, although Triple-A has not disclosed the total amount of digital assets lost.

Blockchain security firm PeckShield also drew attention to the suspicious transactions after Specter’s initial findings.

Before the company released its statement, researchers had not determined whether the affected wallets contained company funds, customer assets, or payment recipient balances. Triple-A’s latest update clarified that only company-owned treasury assets were impacted and that customer funds remained segregated from the affected infrastructure.

The company has also not disclosed how the unauthorized access occurred or whether the incident resulted from compromised credentials, infrastructure weaknesses, or another attack method. As a result, the exact cause of the breach remains under investigation.

Assets reportedly moved across multiple blockchains

Earlier analysis from Specter indicated that the suspicious activity involved wallets operating on Ethereum, Solana, TRON and TON, while some reports also identified transactions on Polygon and Arbitrum.

According to the on-chain findings, the transferred assets were swapped and bridged to Ethereum after leaving the affected wallets. Researchers reported that the receiving address accumulated approximately 5,226.66 ETH, valued at roughly $9.7 million when the activity was first identified.

Neither Triple-A nor investigators have publicly identified the suspected attacker. At the time of the company’s announcement, there was also no confirmation that the assets had been transferred to a cryptocurrency exchange, a mixer or another laundering service after reaching Ethereum.

Triple-A said it is working with internal and external cybersecurity experts, blockchain forensics specialists and relevant authorities, including the Singapore Police Force, to investigate the incident, trace the affected assets and support recovery efforts.

The company did not provide a timeline for completing the investigation or indicate whether any portion of the stolen assets has been frozen or recovered.

Latest incident adds to active year for crypto security breaches

The incident comes as blockchain security researchers continue to report a steady stream of attacks targeting cryptocurrency platforms and decentralized finance protocols throughout 2026.

Last week, decentralized finance protocol Lien Finance disclosed a loss of about 542,144.63 USDC after attackers exploited flaws in its bond validation and pricing logic. Blockchain security firm SlowMist said the exploit allowed unsupported bond tokens to be created and exchanged for real USDC liquidity without consuming the required collateral.

Separate analysis from DefimonAlerts and researcher exvulsec described the attack as a protocol validation and valuation failure rather than a conventional smart contract exploit, while researchers compared parts of the incident with the earlier Drift Protocol attack because both involved weaknesses in asset valuation rather than cryptographic protections.

Researchers tracking decentralized finance attacks have estimated cumulative losses exceeding $630 million during the first seven months of 2026, identifying oracle manipulation, pricing flaws, compromised credentials and bridge validation weaknesses among the most common attack methods recorded this year.

Another major investigation also remained active this week after wallets tied to the $285 million Drift Protocol exploit resumed moving funds following roughly three months of inactivity. On-chain records showed that more than 23,095 ETH, worth about $44.4 million, was transferred into Tornado Cash, making the movement of stolen assets more difficult to trace.

Coinbase chief executive Brian Armstrong said artificial intelligence and crypto are not rival trends.

Instead, he argued that crypto will provide financial infrastructure for autonomous AI agents.

In a July 27 post on X, Armstrong said agents “will eventually transact far more per day than all humans combined.” He presented that outcome as a forecast for payments and other financial actions online.

Armstrong said AI agents cannot use traditional banking services like people or companies. They may need to pay for data, software, computing power and other agents without human approval. He said blockchains and stablecoins can provide fast, programmable and global settlement.

Armstrong frames crypto as AI’s financial layer

Armstrong’s post responded to the idea that crypto companies should abandon blockchain work and move into AI. He rejected that choice. In his view, AI supplies programmable intelligence, while crypto supplies programmable money. He called the combined model “Agentic Finance,” or “AiFi,” and said Coinbase is building products for that market.

The Coinbase chief did not give a date for agents to exceed human transaction counts or estimate payment value. His statement focused on frequency, which could rise if software pays small amounts for every API call, data request or computing task. That model differs from consumer payments, which usually involve fewer and larger purchases.

Coinbase expands its Agentic Finance products

Coinbase has already released several products aimed at autonomous software. In June, it launched Coinbase for Agents, which connects AI systems to user accounts through a command-line interface and Model Context Protocol tools. Users can set limits while agents trade crypto, monitor markets, rebalance portfolios and execute defined financial tasks.

On July 23, Coinbase expanded that service with live market data and plain-language conditional commands. It also added x402 support for Coinbase Business, allowing companies to accept USDC payments initiated by AI agents. A new developer kit lets websites and API providers add x402 payment acceptance with a small amount of code. As crypto.news reported, the rollout covers businesses, users and developers building agent services.

The exchange introduced Agentic.market in April. The marketplace lets agents find and pay for data, search, computing, inference and trading tools. Coinbase calls it a discovery layer for machine commerce because agents can locate services and buy access without a conventional subscription or manually issued API key.

x402, Base and USDC anchor Coinbase’s strategy

Armstrong said Coinbase pioneered the model through x402, Base and USDC. x402 adapts the HTTP 402 “Payment Required” response so a website or API can request payment during an internet interaction. A wallet signs the payment, a facilitator checks it, and the service delivers the requested resource after approval.

Coinbase uses USDC as the main payment asset in many x402 products, while Base provides low-cost blockchain settlement. The protocol also supports other networks and assets. Coinbase’s developer documentation lists support across Base, Solana, Polygon, Arbitrum and World, depending on the payment method and facilitator.

As crypto.news previously reported, Coinbase said AI agents already use x402 to buy data, computing resources and digital services. Related coverage also reported that Coinbase Business customers can now receive USDC directly from agents. These products turn Armstrong’s wider claim into a commercial strategy built around wallets, stablecoins, trading access and payment tools.

Forecast remains unproven as researchers flag risks

Armstrong’s claim remains a prediction. Current totals do not prove that independent AI agents have formed an economy larger than human commerce. A July paper examining x402 activity on Base found highly concentrated transaction counts. Its authors also said some payments were internal or cheap to generate, making headline totals a weak adoption measure.

Separate July research tested 15 x402 facilitators and reported rule violations across every system examined. The researchers described risks involving unpaid services, asset theft, denial of service and gas abuse. They said affected providers, including Coinbase, received the findings and adopted fixes. The papers remain preprints and have not completed peer review.

Regulators are also studying automated finance. Bank of England Deputy Governor Sarah Breeden said in June that existing rules did not account for autonomous agents. She raised the possible use of guardrails, circuit breakers and stronger recovery systems if AI-driven trading or payments create wider problems.

Coinbase continues to position crypto as the payment layer for machine activity. Armstrong’s latest post connects that strategy to a larger claim: agents may become economic actors that hold funds and transact at high frequency. Whether they overtake humans will depend on real usage, security, regulation and demand for paid machine services.

Storj Labs has filed for Chapter 11 bankruptcy protection after raising about $35 million through venture funding, grants and its 2017 STORJ token sale.

The company filed the case on July 26 in the U.S. Bankruptcy Court for the Northern District of West Virginia under case number 5:26-bk-00512.

According to Storj’s official restructuring announcement, the filing aims to address older financial obligations while allowing the decentralized cloud storage company to continue operating. Storj said customer services, its network and its main business would continue during the court process, subject to bankruptcy rules and court approval.

Storj seeks to address legacy debt

Storj described the Chapter 11 case as a restructuring rather than a shutdown. The company said it plans to continue normal operations while it works through debts linked to an earlier stage of the business. However, the announcement did not provide a full list of assets, liabilities or creditors.

Kaloyan Raev, Storj’s director of software engineering, said the business was “strong and right-sized” but remained held back by “legacy obligations from an earlier chapter.” The statement reflects the company’s position, but the bankruptcy court will still review its finances, creditor claims and any proposed reorganization plan.

Storj also said it has narrowed its focus to its core cloud business. It is disposing of earlier acquisitions and non-essential operations as part of that process. Inveniam supports the restructuring and said the company should return its attention to distributed storage, compute and file-access services.

Inveniam announced an agreement to acquire Storj in October 2025. The companies said Storj would remain a separate legal entity and operate as an Inveniam subsidiary. They also said existing customer, supplier and community relationships would remain in place.

Services expected to continue during Chapter 11

Storj said it “does not anticipate any interruptions” to customer services during the bankruptcy process. That wording expresses an expectation rather than a guarantee. The company must continue meeting its obligations under bankruptcy law, and some business decisions may require approval from the court.

The Storj network uses independent storage providers to supply unused storage capacity. Customers can access distributed cloud storage through tools designed to work with common business systems. The STORJ token supports payments across parts of the network, including compensation for node operators who provide storage and bandwidth.

The company’s official website continued to advertise cloud storage, file access and compute products after the filing. Storj has not announced changes to the token’s network role. Still, the bankruptcy concerns Storj Labs as a company, and the court process may shape its ownership, finances and business structure.

Before the filing, Storj had also adjusted parts of its cloud storage business. The company announced new storage and egress prices that took effect on July 1, 2026, while maintaining separate terms for some customers using older plans.

Token holders may join ownership proposal

Storj said management, community members, STORJ holders, current investors and possible new investors could share ownership of the reorganized company. The announcement described this as a plan, not a completed arrangement. It did not state how many token holders could qualify or how ownership would be allocated.

Any ownership proposal must appear in a formal Chapter 11 plan and receive the required creditor support and court approval. Storj has not disclosed conversion terms, eligibility rules, valuation details or a timetable. Therefore, holding STORJ does not currently give a confirmed right to shares in the reorganized business.

The proposed structure differs from the court-supervised asset-sale approach used by some other crypto companies. As crypto.news reported, Poolin entered Chapter 11 while pursuing a sale of its Texas bitcoin mining assets. The mining company reported about $173.1 million in obligations before filing.

Similarly, Movement Labs filed for Chapter 11 in July with liabilities that could reach $10 million. Meanwhile, a separate developer said work on the Movement blockchain would continue despite the original company’s bankruptcy case.

Storj raised about $35 million before filing

Storj completed a $30 million STORJ token sale in May 2017. The sale reached its target in seven days, although the company had initially scheduled it to remain open until June 19. Participants received STORJ tokens that they could use within the storage ecosystem.

The company also raised traditional funding before and around the token sale. Storj announced a$3 million seed round in February 2017 to support development of its distributed cloud storage platform. The round included investors linked to Qualcomm Ventures and Techstars.

CB Insights funding data places Storj’s total equity funding at about $5.05 million across six rounds. Combined with the token sale, the publicly reported amount reaches roughly $35 million.

Inveniam’s October 2025 acquisition announcement said Storj would retain its existing services, leadership and community relationships. It also said the STORJ token would remain part of the company’s decentralized infrastructure.

The bankruptcy filing came about nine months after that acquisition announcement. Storj has not yet released a full reorganization plan, detailed creditor schedule or final ownership terms. Future court filings should provide more information about its debts, available financing, asset sales and the proposed role for token holders.

WEMIX confirmed that an attacker took control of owner privileges linked to its WEMIX$ stablecoin contract on July 26.

The access allowed the attacker to create tokens without approval and move assets through several blockchain networks. An early Korean report valued the abnormal issuance and transfers at about $6.25 million. A later WEMIX update gave a more detailed figure of roughly 5.23 million WEMIX$ minted.

The company said the incident began at about 9:17 UTC, or 6:17 p.m. in South Korea. WEMIX identified suspected attacker wallets and asked exchanges and stablecoin issuers to help freeze the assets. It also started tracing the transactions with blockchain security companies. The cause of the owner-privilege compromise remains under investigation, and WEMIX warned that its initial figures may change.

Attacker converts minted WEMIX$ into other assets

According to WEMIX’s official incident update, the attacker issued about 5,225,525 WEMIX$ without permission. The attacker then converted the tokens into 30,736 WEMIX and 724,198.27 USDC.e. This official breakdown differs from the first $6.25 million estimate, which covered the wider abnormal issuance and movement reported on-chain.

The attacker bridged USDC.e to Ethereum and BNB Smart Chain before swapping parts of the funds into assets including ETH and USDT. Some assets also reached centralised exchanges. WEMIX said several exchanges had frozen linked addresses after receiving requests for help. However, the company has not named those exchanges or stated how much money remains frozen, recoverable or under attacker control.

The company has not said whether ordinary user balances were directly affected. It also has not published a full list of compromised contracts, transaction hashes or recovery amounts. Those details matter because the nominal value of tokens created does not equal the amount successfully converted and removed. WEMIX said its review now continues across several networks.

WEMIX suspends bridges and affected services

WEMIX temporarily stopped all bridges connected to the WEMIX3.0 network. The suspension covered Chainlink CCIP and the PLAY Bridge. The company also paused trading in affected liquidity pools, removed foundation-provided liquidity and stopped the WEMIX$ Module and PNIX decentralised exchange. These steps aimed to block additional transfers while the team reviewed contract permissions and related systems.

In its first notice, WEMIX said it had confirmed abnormal transactions and was “currently analysing the cause of the incident and taking emergency measures.” The company said it would publish more findings as investigators confirm them. It also asked users to rely on official channels instead of unverified posts. WEMIX may contact law enforcement agencies if tracing work identifies evidence that requires formal action.

Stablecoin loses peg during planned USDC.e transition

WEMIX$ was designed to track the U.S. dollar on the WEMIX3.0 network. CoinGecko data showed the stablecoin falling close to its recorded low after the breach, with a weekly decline of about 98.9%. The price move followed the unauthorised minting and rapid conversion of newly created tokens, although the final financial loss remains separate from the amount minted.

The incident came while WEMIX was already replacing WEMIX$ with USDC.e across its gaming and financial services. In March, the company announced that WEMIX PLAY would change its base currency from WEMIX$ to USDC.e. It scheduled the main service transition for April and began closing or reorganising older WEMIX$ pools. The breached contract therefore belonged to a stablecoin system already moving toward reduced use.

New breach follows the 2025 Play Bridge hack

The latest event follows a separate WEMIX security breach in February 2025. As crypto.news previously reported, attackers removed about 8.6 million WEMIX tokens, then worth roughly $6.04 million, from the Play Bridge Vault. WEMIX shut the affected server and reported the case to the Seoul Metropolitan Police Agency’s cyber investigation unit.

That earlier incident also led to criticism because WEMIX disclosed it several days after discovering the breach. South Korea’s major exchanges later delisted WEMIX in June 2025. As related crypto.news coverage noted, Upbit, Bithumb, Coinone, Korbit and Gopax coordinated the action through the Digital Asset Exchange Alliance. The new contract breach occurred as the project approached the period when a future domestic relisting application could become possible.

WEMIX has not released a final attack report, named the source of the stolen owner credentials or confirmed the total unrecovered loss. Its latest response focuses on wallet tracing, service suspensions, asset-freeze requests and contract analysis. Further notices are expected to clarify whether the attacker exploited code, obtained a private key or accessed an internal account with contract-control rights.

BitMart’s planned wind-down is starting to show up in customer withdrawal behavior, according to blockchain monitoring and ongoing user reports. While withdrawals remain available, analytics tracking suggests activity has slowed sharply after the exchange moved toward ending services.

On Monday, Lookonchain reported that only 58 wallets withdrew roughly $805,000 over more than 24 hours, and that BitMart had not processed any withdrawals during the most recent eight-hour window the firm tracked. Separately, multiple users on X described delays or inconsistencies with withdrawal processing, though the claims could not be independently verified.

Key takeaways

• Lookonchain data indicates withdrawal activity from BitMart slowed to near-zero during at least one tracked eight-hour period.
• Users on X reported withdrawal freezes and transactions marked as completed without clear on-chain processing, but these reports were not verified.
• BitMart has said withdrawals will continue, though requests may undergo additional compliance and security checks.
• BitMart’s closure schedule remains under focus: trading is set to end Aug. 26, with full cessation expected by Jan. 31, 2027.
• BitMart’s token (BMX) continued to fall after the shutdown announcement, reflecting deteriorating market sentiment.

Withdrawal activity appears to stall as wind-down proceeds

Lookonchain’s Monday update framed the slowdown through wallet-level monitoring, with 58 wallets withdrawing about $805,000 over a little more than a day. The same report said BitMart did not process withdrawals during the latest eight-hour segment it analyzed, suggesting operational throttling or slower throughput during the wind-down transition.

Beyond the analytics snapshot, social media users continued to post about withdrawal issues. One X user said they received an email claiming a USDT withdrawal had been completed, while their account still showed an “on-chain withdrawal freeze” and the transaction was not processed on-chain. Another user claimed a $30 test withdrawal remained pending for more than 30 minutes. These accounts were presented as individual experiences and were not confirmed by independent evidence in the reporting.

For customers, the practical question is whether BitMart can convert “orderly wind-down” promises into consistently processed outflows. Even when withdrawals remain technically enabled, delays can intensify concern—especially if customers suspect internal holds, address checks, or longer verification queues than before.

BitMart says withdrawals remain available, but checks may tighten

BitMart previously told customers that withdrawals would still be supported while operations unwind. However, it warned that withdrawal requests could face additional compliance and security controls. The exchange’s notice indicated that review processes may include checks of customer identity details, login devices, withdrawal addresses, trading history, and sources of funds.

BitMart also suggested it might request further proof, including identity verification, confirmation of address details, evidence relating to the source of funds, and—where relevant—ownership of the receiving wallet. That framework matters because it points to a mechanism for why withdrawals could appear slower even if the exchange intends to process them eventually.

Cointelegraph attempted to obtain comments from BitMart but did not receive a response before publication. That leaves customers and observers reliant on the exchange’s published guidance, third-party tracking, and user reports to gauge whether checks are running normally or becoming a bottleneck.

Trading ends in stages; platform closure timetable remains the same

The withdrawal scrutiny comes after BitMart announced a staged exit from its business. In its Sunday update, the exchange said it would stop accepting new registrations and deposits, while restricting new spot orders and futures positions.

According to the schedule outlined at the time, trading services are expected to end on Aug. 26. The exchange also stated that the platform will cease operations entirely on Jan. 31, 2027. This longer runway means BitMart’s ability to keep customer exits working—especially during the period leading up to Aug. 26—may be one of the clearest near-term signals of how smoothly it intends to handle assets.

As the wind-down progresses, blockchain visibility adds another layer to the story. Arkham, via its entity explorer, attributed about $69 million in crypto assets to BitMart-linked wallets on Monday, down from roughly $102 million on July 6. While wallet attribution does not automatically confirm which assets remain available to customers at any given moment, the trend is consistent with gradual movements and reallocations during the closure process.

BMX token slumps; acquisition questions return

BitMart’s token performance has also reflected mounting concerns around exchange risk. CoinGecko data showed BMX trading near $0.057 on Monday and down about 81.5% over seven days. Earlier in the week, the token was reportedly around $0.31 late Friday after BitMart’s shutdown plans became public.

Token declines during an exchange wind-down are common, but the magnitude can indicate how aggressively traders are repricing uncertainty around liquidity, support, and distribution mechanics during cessation. For tokenholders and observers, it also underscores the market’s expectation that the transition will not be smooth for all participants.

The closure has revived questions about consolidation in centralized exchanges. Changpeng Zhao, Binance co-founder, commented on X that acquiring a centralized exchange can be more complicated than buying other businesses. He argued that buyers could inherit security vulnerabilities, including backdoors left by prior teams, adding that acquisitions are possible but require greater scrutiny.

In that context, BitMart’s winding down may affect how potential acquirers evaluate operational continuity, customer asset handling processes, and technical risk. Even where an acquisition is feasible on paper, the practical challenges of verifying controls and safeguarding assets can be substantial—especially for platforms already reducing activity and limiting new access.

Looking ahead, customers and market participants should watch whether withdrawal processing returns to steady throughput as checks are completed and whether third-party monitoring shows sustained transaction activity rather than intermittent gaps. Until BitMart demonstrates consistent outflows across different assets and user reports, uncertainty around the final stages of the wind-down is likely to remain a central issue.