MPC钱包深度研究

August 9, 2026 · Observing self-custody and key security
The Coldcard incident has entered its second week. The firmware batch with the entropy-source issue is no longer news—what’s worth watching is where the money is going. Over the past week, two sets of numbers appeared at the same time, and the directions appear to be opposite.
First, look on-chain. Glassnode data shows that in the past week, about 210,000 BTC flowed out of long-term holder (LTH) wallets, the largest decline since December 2024. [2] Glassnode defines LTHs as entities that have been holding their coins in silence for about 155 days—more than five months. [2] This supply is now around 14.7 million BTC; before the event, it was close to 15 million BTC, when it was approaching the all-time high. [2]

August 8, 2026 · Self-custody and key security watch
In the early hours of July 30, the attackers began moving Bitcoin out of Coldcard hardware wallets. In the first wave, within 25 minutes, they moved 594 BTC from around 500 wallets—worth about $38 million at the time.[1] Galaxy Research characterized these clearing actions as taking place in a 41-minute window from 01:10 to 01:51 UTC, spread across nine blocks.[5]
That was just the beginning. As of August 5, TRM Labs cited Galaxy’s tracking data: across four waves of attacks, a total of about 1,816 BTC was transferred out, involving more than 5,200 addresses, worth nearly $116 million at the time.[1] This was the third-largest large-scale crypto attack event in 2026, and it also pushed the total stolen amount this year beyond $1.2 billion, involving 276 incidents.[1]