冷钱包事件新进展：黑客转移45%被盗比特币
BiFu Editorial · 2026-09-09 · 阅读 3 分钟
目录
Galaxy Research确认，Coldcard第三次攻击波的黑客已转移45%被盗比特币，清空11个最大金库。约82%被盗资金仍留在原始地址，18%已通过洗钱渠道转移，影响受害者及追踪资金的交易所。
四个独立消息源证实了Coldcard盗窃案的重大进展：第三波攻击的黑客已转移45%被盗比特币，清空了11个最大金库。这一变化影响了Galaxy Research确认的190名受害者，以及交易所和分析公司，它们现在必须追踪活跃转移的资金，而非静态的被盗余额。
操作层面的影响在于，转移模式表明资金正在被积极清洗，而非处于休眠状态，这改变了托管方和调查人员对地址监控的优先级排序。
第三波攻击发生了什么变化
CoinDesk报道称，Coldcard黑客转移了价值$7.7 million的BTC，占第三波攻击中被盗比特币的45%。Galaxy Research表示，黑客现已清空与该波攻击相关的11个最大金库，这意味着最大规模被盗资金不再闲置。Decrypt补充道，黑客为被盗比特币建立了293个独立金库，并按规模从大到小逐一清空。
这种有条不紊的方式为调查人员提供了可预测的顺序，但也意味着最大可追回金额正在以最快速度转移。
The Block确认了相同的45%数据，并引用了Galaxy 8月中旬的数据：约1,779 BTC从190名受害者手中被盗，涉及超过8,600个地址。地址数量的规模很重要，因为它将被盗资金分散到众多钱包中，使得任何单一扣押或冻结请求都更加复杂。对交易所而言，这意味着需要筛查的是一份不断增长的标记地址清单，而非一个可识别的钱包。
资金转移影响了谁
受影响方包括Galaxy Research确认的190名受害者、可能收到污染资金的交易所，以及维护地址监控名单的分析公司。Cointelegraph报道称，Galaxy表示所有Coldcard攻击中被盗比特币的82%仍留在原始地址，18%已通过疑似洗钱方式转移。根据Cointelegraph的报道，洗钱似乎涉及THORChain或CoinJoin交易，这给合规团队带来了实际问题，因为这些方法掩盖了目标钱包。
对于使用Coldcard设备的比特币持有者而言，确认的变化并非硬件本身出现新漏洞，而是早期漏洞中资金持续转移。操作后果是，任何接收来自标记地址比特币的交易所将面临更高的合规负担。处理大额比特币流动的托管机构和机构交易台需要检查其筛查工具是否覆盖Galaxy确认的8,600多个地址，因为黑客正在积极整合和转移资金。
Coldcard事件中尚未确认的信息
尚未确认的是45%的转移数据是否仅涵盖第三波攻击，还是包括更早的攻击波。Galaxy 8月中旬的数据覆盖约1,779 BTC、190名受害者，但该总数与Decrypt描述的293个金库之间的关系在源文档中并未完全明确。
Cointelegraph报道的82%静态数据适用于所有Coldcard攻击，而45%转移数据专门针对第三波攻击，因此读者不应在未查阅Galaxy原始报告的情况下合并这两个百分比。
下一步需核实的源文档是Galaxy Research的完整报告，该报告应澄清293个金库是仅属于第三波攻击，还是跨越多个攻击波。还应确认被清空的11个金库是否持有1,779 BTC总量中不成比例的份额。在该文档被查阅之前，已确认的事实包括：45%的转移量、11个被清空的金库、293个金库的结构，以及所有攻击中82%的静态余额。
对于追踪比特币安全事件的BiFu读者而言，实际操作建议是将8,600多个标记地址视为一个活跃的洗钱网络，而非静态的盗窃记录。下一步验证步骤是检查Galaxy是否自8月中旬以来发布了更新的地址列表，因为攻击者的持续转移意味着任何早于该日期的监控列表已不完整。
参考文献
- https://www.coindesk.com/business/2026/09/07/coldcard-hacker-moves-45-of-bitcoin-stolen-in-third-attack-wave
- https://cointelegraph.com/news/coldcard-third-wave-attacker-moves-bitcoin-stolen
- https://decrypt.co/377537/coldcard-hacker-moves-7-7m-nearly-half-of-third-wave-bitcoin-haul
- https://www.theblock.co/news/defi/2026-09-07-coldcard-exploiter-moves-wave-3-413661
阅读更多 BiFu 内容
Galaxy Research确认，Coldcard第三次攻击波的黑客已转移45%被盗比特币，清空11个最大金库。约82%被盗资金仍留在原始地址，18%已通过洗钱渠道转移，影响受害者及追踪资金的交易所。
风险警告
Trading foreign exchange, contracts for difference, over-the-counter derivatives, margin products, and other leveraged financial instruments involves a high level of risk and may not be suitable for all clients. These products can result in losses that may exceed your initial deposit, depending on the product terms, account settings, and applicable legal protections. You should not trade unless you fully understand the nature of the products, the risks involved, and the extent of your exposure. When trading derivative products, you do not own or have any rights to the underlying asset.
The information provided on this website is general in nature and does not take into account your investment objectives, financial situation, trading experience, or particular needs. Nothing on this website should be construed as personal financial advice, investment advice, an offer, invitation, solicitation, recommendation, or inducement to buy, sell, subscribe for, or dispose of any financial product or service.
All market commentary, educational materials, research content, platform information, and other materials published on this website are provided for general information and reference purposes only. Past performance, historical data, examples, forecasts, or simulated results are not reliable indicators of future performance.
Access to Bifu Markets’ products and services is not available in all jurisdictions. We do not open accounts for residents of certain countries and jurisdictions, including but not limited to the United States, Australia, Canada, and the Democratic People's Republic of Korea.
By accessing this website, you confirm that you are doing so on your own initiative and that you are responsible for ensuring that your use of this website and any services provided by Bifu Markets complies with the laws and regulations applicable to you in your jurisdiction.
Bifu is operated by Bifu Markets (Pty) Ltd.
Registered address: Norwich Place West, 2nd Floor, Cnr 5th and Norwich, Sandown, Sandton, Gauteng, South Africa.