Triple-A hot wallet losses have been revised upward from $9.3 million to about $11.8 million.

Let’s not discuss who the attacker is.
Just look at the timeline.
On-chain investigator Specter initially found multiple abnormal outgoing transfers and estimated losses exceeding $9.3 million. PeckShield later traced a consolidation address that at one point held about 5,226 ETH, then worth about $9.73 million.
After that, losses from other networks were added in.
Including Bitcoin, TRON, Polygon, Arbitrum, Solana, and TON. The combined estimate rose to about $11.8 million.
The part that needs the most explanation isn’t the amount.
It’s the deposit entry point.
According to Specter’s disclosure, even after more than 30 hours had passed since the first batch of large abnormal withdrawals appeared, new deposits were still entering the related hot wallets and continued to be sent to the same consolidation address.
If this timeline is accurate, the problem isn’t just a single private key being compromised.
It also includes why deposits weren’t paused in time, addresses weren’t isolated, or the consolidation route wasn’t changed after the anomaly occurred.
Speaking for Triple-A according to the rules.
The company said customer funds were not affected. Hot wallet losses don’t necessarily mean customer asset losses; the platform may use its own liquidity to cover the shortfall, or it may isolate users’ balances from operational wallets.
There is currently no complete audit document proving that customer balances have a deficit.
So we can’t write “customer funds were stolen.”
But “customer funds were not affected” is still a company statement that needs to be verified, not a conclusion automatically proven by on-chain data.
What needs to be examined next is four things:
A complete list of affected addresses.
The time when the first abnormal outgoing transfer was discovered.
The time when the platform actually paused deposits.
Who ultimately bears the $11.8 million.
If the attack happened, that’s a security issue.
If new money kept entering while the attack was ongoing, that’s a response issue.
The former could come from a vulnerability.
The latter requires a complete timeline.
At present, there’s still uncertainty.
Wait for the address list, the announcements, and the audit report.