Unauthorized Access Incident at Triple-A Limited to Treasury Assets

• •Unauthorized access occurred on July 25, 2026, affecting only Triple-A's treasury assets.
• •Client funds were not impacted, as they are held in separate trust accounts.
• •The incident was contained within three hours, and services resumed normally.

On July 25, 2026, Triple-A detected unauthorized access to certain operational wallets of its Singapore entity, affecting only the company's own digital assets. The incident was contained within approximately three hours, and all client transactions continued normally. Client funds were not impacted, as they are held separately in trust accounts. The attack was attributed to social engineering rather than technical vulnerabilities. Triple-A has engaged cybersecurity experts and authorities to investigate the breach and trace the affected assets. The financial impact is confined to treasury assets, which will be fully absorbed by the company's reserves. All services have since been restored, and operations are running normally across all markets.