MPC钱包深度研究

2026-08-17 · Observations on self-custody and key security
No key leakage does not mean there is no risk. According to SafePal’s disclosure on August 16, its order-tracking plugin has an authorization flaw that, under certain conditions, could allow an unauthorized party to access other customers’ order information. Affected data includes name, email, shipping address, phone number, and purchase details, impacting approximately 39,798 customers.
SafePal states that the event does not involve a mnemonic phrase, private key, wallet password, bank card information, or government-issued identification documents, and there is no evidence showing that the wallet or funds were compromised as a result. However, order data turns the fact that “someone owns a hardware wallet” into a profile that can be used for targeted phishing: attackers know how to contact them, where the hardware might be shipped, and how to disguise themselves using after-sales support, replacement services, or firmware reminders.

一段看起来像 API 文档的网页，可以同时服务两类读者：人类看到的是排错和付费入口；会浏览网页、调用工具并能付款的 Agent 还会读到藏在结构化数据和 DOM 里的“指令”。
Zscaler ThreatLabz 披露的案例里，攻击者用 SEO 投毒把假模块页面推给搜索者，再把“购买许可证即可解决错误”的内容写进 JSON-LD 与屏幕外的 HTML 节点。
这不是传统意义上的“用户点错链接”。当 Agent 把网页当作任务上下文时，页面正文、元数据、错误提示和工具说明都会进入它的决策链。该案例把支付描述成例行的 API key 获取步骤，并包含向硬编码地址转移约 0.0012 ETH 的脚本；攻击者随后给出假 API key，让一次付款看起来像任务完成。
真正需要重画的是授权边界。网页可以提供信息，却不能凭页面里的文字扩大 Agent 的付款权。搜索结果排得更靠前、字段看起来更结构化，或错误信息显得更紧急，都不应自动变成“允许向新地址付款”的理由。
ThreatLabz 的内部测试评估了 26 个模型：四个模型在相关攻击场景中未采取恰当行动，另有两个模型未能在仿冒加密平台场景中正确识别网站。SecurityWeek 对该研究的报道也指出，攻击者通过隐藏提示、操纵搜索结果和仿冒站点，诱导 Agent 付款或信任虚假平台。
对会执行支付的 Agent，最有用的默认规则不是“发现恶意提示再拦截”，而是把外部网页降级为不可信输入：
1. 网页、检索结果和工具返回值不得自行新增收款方、资产类型或付款额度；
2. 首次向新地址付款，应触发独立确认，而不是沿用页面中的付款参数；
3. 付款策略应预先限定金额、允许对象与有效时间，并保留可复核的意图记录；
4. 页面声称“立即付款才能修复”时，应该是暂停信号，不是授权信号。
支付协议能记录一笔交易是否被签名；它不能替用户判断这笔交易最初是不是被一段隐藏网页内容诱导出来的。对 Agent 而言，付款安全的起点不是让它读懂更多页面，而是让页面永远无法替人扩大权限。
信源：Zscaler ThreatLabz《Indirect Prompt Injection in Web Content Targets AI Agents》；SecurityWeek《Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments》。

August 16, 2026
When an agent can independently call services and pay fees, the issue is not only where the keys are stored, but also whether this action is still within the authorized scope.
According to Cloudflare’s public documentation, its wallet solution distinguishes between an Account Wallet managed by the account owner and a Virtual Wallet used for agent operations. The former can be funded, can delegate spend, and can withdraw funds, while the latter operates according to permissions. The safeguards listed in this solution include allowance, an allow list, and a per-transaction spending limit, and the agent’s maximum spend is constrained by a quota set by the account owner.

August 15, 2026 · A look at self-custody and key security
The lesson from last week is that a hardware wallet doesn’t automatically mean you’re safely within a defined risk boundary; this week, the discussion has started moving earlier—from “whether the device is offline” to how the keys are generated.
According to a Cointelegraph report on August 14, the Coldcard incident has once again brought self-custody risks back into the spotlight of market discussion; the report also states that U.S. spot Bitcoin ETFs saw net inflows of about $1 billion for the week, but analysts explicitly caution that inflows cannot be directly used to infer causation with the incident.

August 14, 2026 · Observations on self-custody and AI agent security
1. The attack surface of hardware wallets isn’t limited to devices and private keys.
According to a Trezor announcement, their logistics provider ShipMonk was accessed without authorization: the names, email addresses, phone numbers, and shipping addresses of 11,742 customers were exposed, and another 1,947 people had their names, cities, and email addresses affected. The devices and Trezor’s own systems were not compromised; however, identity and logistics information can enable more precise phishing, fake customer service, and fake delivery risks.
2. An AI agent’s “hidden reasoning” may also become supply-chain data.

After the incident, large amounts of Bitcoin were moved
August 13, 2026 · Self-custody and key security watch
Late July Coldcard vulnerability led to about 1,816 bitcoins being stolen, but on-chain data shows that subsequently 233,000 BTC were moved out of long-term holding wallets, with 22,000 going to exchanges. [1] Casa CEO Nick Neuman said that 10 to 100 times the stolen amount was transferred to a safe location.
These migrations had two sources: some Casa customers originally used single-signature Ledger or Trezor (completely different device brands), but this incident prompted them to switch to multi-signature wallets; the other group were users already using multi-sig, who removed the Coldcard device from the key combination. [1]

2026-08-12
This week, self-custody defenses were hit by two problems at once: the firmware vulnerability in the hardware wallet Coldcard pushed more than 230k bitcoins out of the wallets of long-term holders, and, according to reports by Bitcoin Magazine and Decrypt, leaked Lightning Network credentials for the open-source payment processor BTCPay Server forced the project team to announce that “security patches will take priority over new features indefinitely”
## Coldcard vulnerability triggers large-scale fund transfers
A random number generator flaw that had been buried in the Coldcard firmware as far back as 2021 was exploited by attackers, resulting in at least 1,816 bitcoins (about $116 million) being stolen. Casa CEO Nick Neuman cited on-chain data showing that, in the days after Coldcard was attacked, 2.1k bitcoins were stolen, 22k bitcoins were moved to exchanges, and 233k bitcoins left the wallets of long-term holders. Neuman believes these figures prove that self-custody strengthens Bitcoin’s resilience as an asset class

2026-08-12
This week, the defenses of self-custody wallets were struck by two layers of problems at once: a firmware vulnerability in the hardware wallet Coldcard drove more than 230,000 bitcoins out of long-term holders’ wallets, and, according to reports by Bitcoin Magazine and Decrypt, a leak of Lightning Network credentials from the open-source payment processor BTCPay Server forced the project team to announce that “security patches will take priority over new features indefinitely”
## Coldcard vulnerability triggers large-scale fund transfers
An attacker exploited a random number generator flaw that had been buried in Coldcard firmware as early as 2021. To date, it has reportedly led to at least 1,816 bitcoins (about $116 million) being stolen. Casa CEO Nick Neuman cited on-chain data to show that within days after Coldcard was attacked, 2.1k bitcoins were stolen, 22k bitcoins were moved to exchanges, and 233k bitcoins left long-term holders’ wallets. Neuman believes these figures prove that self-custody has strengthened Bitcoin’s resilience as an asset class

August 11, 2026
Last week’s lesson was how hardware wallet keys are generated. This week it’s a new layer: the key itself hasn’t been computed, but the ring of things around the key is being accelerated by AI to be cracked open.
The attacker is no longer “just used AI for a bit.”
A report released on August 10 by the South Korean security company Genians said that while tracking the C2 infrastructure logs of the North Korea-linked hacker group Kimsuky, it found evidence that the group had set up its own local large-model environment—installation records were left for all three tools: Ollama, GPT4All, and Msty. Having all three installed indicates this wasn’t a quick trial, but a sideways comparison of multiple ways to run local models.

August 10, 2026 · Self-custody and key security watch
Last week’s lesson was how seeds are generated; this week’s lesson adds a layer: the wallet itself is fine—the thing next to the wallet is what went wrong.
According to a CoinDesk report, late on August 7, the attackers emptied out a batch of Lightning Network nodes running behind the BTCPay Server. BTCPay confirmed that the funds were stolen and urged everyone running LND to immediately upgrade to version 2.4.2 or take their servers offline. The nature of the flaw is noteworthy: unauthenticated remote attackers can obtain the “.macaroon” file—which is the credential used for an authorized software to interact with the LND node. That means the attackers never touched any private keys from start to finish; what they got was essentially a “passport that represents you speaking,” and then they used it to take over the node, close channels, and sweep the money away.

August 9, 2026 · Observing self-custody and key security
The Coldcard incident has entered its second week. The firmware batch with the entropy-source issue is no longer news—what’s worth watching is where the money is going. Over the past week, two sets of numbers appeared at the same time, and the directions appear to be opposite.
First, look on-chain. Glassnode data shows that in the past week, about 210,000 BTC flowed out of long-term holder (LTH) wallets, the largest decline since December 2024. [2] Glassnode defines LTHs as entities that have been holding their coins in silence for about 155 days—more than five months. [2] This supply is now around 14.7 million BTC; before the event, it was close to 15 million BTC, when it was approaching the all-time high. [2]

August 8, 2026 · Self-custody and key security watch
In the early hours of July 30, the attackers began moving Bitcoin out of Coldcard hardware wallets. In the first wave, within 25 minutes, they moved 594 BTC from around 500 wallets—worth about $38 million at the time.[1] Galaxy Research characterized these clearing actions as taking place in a 41-minute window from 01:10 to 01:51 UTC, spread across nine blocks.[5]
That was just the beginning. As of August 5, TRM Labs cited Galaxy’s tracking data: across four waves of attacks, a total of about 1,816 BTC was transferred out, involving more than 5,200 addresses, worth nearly $116 million at the time.[1] This was the third-largest large-scale crypto attack event in 2026, and it also pushed the total stolen amount this year beyond $1.2 billion, involving 276 incidents.[1]