# On-chain fingerprints for MPC-custody wallets on Ethereum mainnet

Research date: 2026-10-29. Balances were taken at blocks 26,299,091 to 26,299,284 (latest as of 2026-10-29). ETH supply used for shares: about 122.2M (Blockscout market cap divided by price).

## TL;DR

MPC ECDSA signatures look like ordinary signatures, so no fingerprint works for all MPC wallets. What does work is **platform infrastructure that MPC EOAs touch**. Four kinds of evidence held up:

| # | Fingerprint | Platforms | Works? | Addresses | ETH now | Attribution confidence |
|---|---|---|---|---|---|---|
| 1 | Platform-specific **EIP-7702 delegate code** on the EOA (`0xef0100‖delegate`) or events emitted from the EOA by that code | Fireblocks (`UniversalGaslessDelegate`), Utila (`Utila7702Delegate`), Dfns (`DfnsSmartAccount`) | **Yes.** Precise, but covers only wallets that opted into gasless or batching features. These wallets hold almost no ETH. | Utila 12,264 (complete event scan). Fireblocks 451 (sample; about 240k extrapolated). Dfns 9 (sample) | Utila 90. Fireblocks delegated EOAs 0.6 (sample, about 330 extrapolated). Fireblocks fee-payer vaults 1,068. Dfns about 16 | high (delegated EOAs), medium (fee payers) |
| 2 | **Factory-deployed forwarder whose parent is an EOA** (BitGo ForwarderFactoryV4) | BitGo TSS/MPC | **Yes.** Complete for BitGo MPC wallets that use forwarder receive addresses. | 205 base EOAs | **6,737** | high |
| 2b | Default **gasLimit = 91000 on plain ETH sends**, priority fee often 1.15 x a round number | BitGo TSS client | Partly. A strong heuristic, but finding addresses needs a block scan. | +11 beyond #2 (from a 1-in-133 block sample) | +687 | medium |
| 3 | **Labeled platform gas funder → funded EOAs** ("gas-station" pattern) | Coinbase Prime / Coinbase Custody, Ceffu, Cobo, Copper, Anchorage | **Yes for Coinbase.** The custody funder tops up the vaults themselves. For Cobo, Ceffu and Copper the funded EOAs are swept deposit addresses holding about 0 ETH. | Coinbase 45,302 (Feb 2024 to Oct 2026 history) | **4,257,240** (+174,639 labeled +28,942 sweep destinations) | medium-high that they are Coinbase-controlled; MPC status of Coinbase custody **not product-documented** |
| 4 | Explorer/OLI **name labels** (not a fingerprint, used as seeds and cross-check) | Copper, Ceffu, Cobo, Coinbase Prime, BitGo (contracts), Fireblocks (one Celsius address) | Seeds only | Copper 53, Ceffu 17, Cobo 61, CB Prime 665 | Copper 87,672 (+2,933 sweep destinations), Ceffu 62,621, Cobo 13,044, CB Prime 174,639 | label |

Things that **did not** work:

- **Fireblocks Gas Station.** Each Fireblocks workspace has its own gas-station vault, so no shared funder exists to pivot on.
- **Generic tx-construction fingerprints for Fireblocks.** Two Fireblocks-attributed groups behave differently from each other and overlap with random EOAs.
- **Copper, Ceffu and Cobo funders as a path to vaults.** Their funders only fuel deposit addresses. The sweep destinations they lead to were already labeled.
- **Fordefi.** No on-chain artifact found.
- **Copper ClearLoop, Ceffu MirrorX, Coinbase Prime vault contracts.** These are off-chain or settlement-layer products, not on-chain contracts.

**Bottom line for the supply-share estimate.** Fingerprints/labels identify about **4.64M ETH (about 3.8% of supply)** in EOAs attributable to the platforms in scope:

- Coinbase Prime/Custody: about 4.46M
- Copper: about 91k
- Ceffu: about 63k
- Cobo: about 13k
- BitGo TSS: about 7.4k
- Fireblocks: about 1.1k
- Utila: about 0.1k

Two caveats dominate:

1. About 96% of it is Coinbase custody. Whether that counts as MPC rests on Coinbase's public statements about its MPC signing engine, not on on-chain evidence.
2. The **Fireblocks figure is a massive undercount**. Fireblocks vault EOAs have no on-chain fingerprint unless they use Universal Gasless, so Fireblocks, probably the largest MPC platform by customer count, is essentially unmeasurable on-chain with public tools. Use off-chain disclosures instead.

Treat all totals as **lower bounds** for their platform.

Files:
- `data/fingerprint/identified_addresses.csv`: 60,458 rows. Columns: platform, address, method, attribution_confidence, mpc_status, eth_balance, code_kind, nonce, balance_block, evidence, also_in_platforms.
- `data/fingerprint/identified_addresses_ge1eth.csv`: 2,517 rows.
- `data/fingerprint/totals_by_platform.csv`
- Raw intermediates: `data/fingerprint/raw/`
- Scripts: `scripts/fingerprint/` (stdlib only; `aggregate.py` rebuilds the CSVs).

The aggregated CSVs also contain exclusion rows (`bitgo_multisig_excluded`, `bitgo_gas_tank`, `anchorage`). **Filter these out before summing MPC ETH.**

---

## Method and data sources

- **RPC:**
  - publicnode for balances, code and nonces. It is non-archive and allows batches of at most about 10.
  - `rpc.mevblocker.io` for `eth_getLogs`. It is the only free endpoint found that accepts **topic-only** queries over any block range when the response has 10k logs or fewer.
  - Flashbots accepts ranges of at most 100k blocks. Others are capped at 50 to 10k blocks or need a key.
- **Balances:** large sets use the DeltaBalances checker contract `0xb1f8e55c7f64d203c1400b9d8555d050f94adf39`, `balances(address[],address[])`, 400 addresses per `eth_call` (`fast_balances.py`).
- **Blockscout v2:** tx lists, verified ABIs/sources, search.
- **Blockscout metadata service:** `metadata.services.blockscout.com/api/v1/tags:search` and `/addresses?slug=…&tagType=…`. It exposes Etherscan-style name tags and OLI labels in bulk. This is how labels were harvested (`harvest_blockscout_tags.py`; 842 tags, 2,085 rows).
- The Blockscout legacy `module=account|logs` API returned HTTP 429 persistently after the first few calls. All log collection was therefore moved to RPC.
- Downloaded data and labels were treated as untrusted. One scam token name on Blockscout contained a prompt-injection "Cobo emergency transfer" instruction. It was ignored.

---

## 1. EIP-7702 delegate fingerprints (Fireblocks, Utila, Dfns)

### What it is

Since Pectra (May 2025), an EOA can set code `0xef0100‖<delegate>`. Several MPC platforms ship their own audited delegate for gasless or batched transactions. An EOA delegated to a platform's delegate was set up by that platform's signer, because the authorization must be signed by the EOA's key. That makes it a platform wallet.

### Evidence

**Fireblocks: `UniversalGaslessDelegate` at `0x0000fb7702036ff9f76044a501ac1aa74cbab16b`**

- Vanity prefix `fb7702`. Deployed 2025-05-06 via the CREATE2 deployer.
- Verified source header: `Copyright (C) 2025 Fireblocks <support@fireblocks.com>`, `@custom:security-contact support@fireblocks.com`.
- Fireblocks' "Universal Gasless" launched in May 2025 as "Fireblocks' first implementation of EIP-7702". In it, the vault "is upgraded into a smart-contract wallet on its first gasless transaction". Sources:
  - [Fireblocks blog](https://www.fireblocks.com/blog/universal-gasless-evm-transactions-launch)
  - [support article](https://support.fireblocks.io/hc/en-us/articles/19948199000092-Universal-Gasless)
  - [community thread](https://community.fireblocks.com/t/eip-7702-set-code-with-fireblock-wallet/2928). Here Fireblocks also states customers *cannot* set arbitrary 7702 code on vaults. This means a vault's only possible Fireblocks delegation is this one.
- The contract emits no custom events. EOAs therefore had to be found from type-4 transactions.

**Utila: `Utila7702Delegate` at `0x03a46a24…7795` (2026-07-25) and `0x5ac4c3f3…ec4c` (2026-09-17), plus an older unverified version `0x242e8090…8713`**

- These emit `UtilaExecutedCalls(bytes32)` (topic `0xc9793ee4…569c`) **from the EOA address**. A topic-only `eth_getLogs` scan from the Pectra block (22,431,084) to head gives a complete list of every Utila wallet that ever executed through the delegate.

**Dfns: `DfnsSmartAccount` (5 versions, e.g. `0xcea43594…a1f512`, tagged "Dfns: EIP-7702 Delegator")**

- No events, so only sampled.

**Fordefi:** contracts named `FordefiPolicyEngine` exist but have 0 transactions. No Fordefi 7702 delegate was seen among 374 sampled delegates.

### Coverage and measurement

- **Utila:** complete scan, 12,264 emitting EOAs, first event at block 24,640,904. Current balance **89.6 ETH**. The 100 addresses with ≥0.05 ETH were code-checked: all are delegated to one of the three delegate versions.
- **Type-4 samples:**
  - 1,500 blocks at 1-in-120 spacing over the last 180k blocks: 5,708 type-4 txs.
  - 800 blocks at 1-in-4,300 spacing over the preceding 3.44M blocks: 1,747 txs.
  - Results: 374 distinct delegates (`raw/type4_delegates_named.csv`).
  - Fireblocks: 451 authorizations, almost all with authorization nonce 0, meaning fresh EOAs. 65 distinct fee payers.
  - Extrapolation: about 49k Fireblocks-delegated EOAs in the last 25 days and about 190k before that, so **about 240k** in total (order of magnitude; Poisson error ±15% on the old sample).
- **Fireblocks delegated EOAs:** the 451 sampled EOAs hold 0.59 ETH (mean 0.0013), which extrapolates to **about 300 ETH**. They are token-payment wallets, consistent with Universal Gasless (ERC-20/721/1155 only, no native ETH).
- **Fireblocks fee payers (type-4 senders):** 65 EOAs holding **1,068 ETH**.
  - Each is funded by different, customer-specific sources. One (`0x7b09fc3b…`, 800 ETH, nonce 470k) is a high-volume ERC-20/ETH hot wallet.
  - They are probably the customer's designated gas-payer **vault**, which is also a Fireblocks MPC vault. This is not proven: Fireblocks also allows a third-party relayer. Confidence: medium.

### False-positive risk

- **Delegated EOAs:** very low. The delegate code is platform-authored, and the authorization is signed by the EOA key, which is the platform's MPC key.
- **Fee payers:** moderate.

### What it does **not** give

The bulk of Fireblocks/Utila/Dfns vaults (treasury, exchange hot/cold wallets) never use 7702. ETH held directly is tiny. This fingerprint is useful as a **seed set** of known-platform addresses, not as a measure of ETH.

---

## 2. BitGo TSS: forwarders whose parent is an EOA

### What it is

BitGo receive addresses are CREATE2 minimal-proxy forwarders that flush to a parent. In BitGo's [eth-multisig-v4 README](https://github.com/BitGo/eth-multisig-v4): "Parent address will be the single sig base address of the wallet. Fee address will be the gas tank address."

BitGo [wallet versions 3/5/6](https://developers.bitgo.com/docs/wallet-forwarder-versions) are MPCv1/MPCv2/native-MPC. The [TSS ETH launch blog](https://bitgo.com/resources/blog/introducing-ethereum-and-erc-20-wallets-on-tss) says TSS replaces "the Multi-Sig smart contract".

Therefore:
- A forwarder parent that is an **EOA** is a BitGo MPC base address.
- A parent that is a **contract** is a WalletSimple multisig, which is not MPC. These are useful for exclusion.

### Evidence

- **Factory addresses** come from BitGoJS `modules/statics/src/networks.ts` (Ethereum class): ForwarderFactoryV4 `0x37996e762fa8b671869740c79eb33f625b3bf92a`, v1 `0xffa39728…37cd`, v2 `0x29Ef4603…1b0C`.
- **All 216,509 `ForwarderCreated` logs** from the V4 factory (since block 19.83M) give 207 parents. 204 are EOAs and 1 is now 7702-delegated. Only 2 parents are contracts.
- **The v1 factory since 2023** (512,721 logs) gives 323 parents, 318 of them contracts (WalletSimple). The **contrast** confirms the semantics.
- A sample of `createForwarder` tx senders shows BitGo gas-tank addresses (`0xf8fa524a…`, `0xe09d6ba2…`) that also appear as `feeAddress`.

### Result

**205 BitGo MPC base addresses, 6,737 ETH.** The largest is `0x7f604d59…b752` with 4,801 ETH and nonce 295k.

| Set | Addresses | ETH | Treatment |
|---|---|---|---|
| Gas tanks (fee addresses) | 129 | 108 | Not counted: key type unknown |
| BitGo multisig contracts (v1/v2 factory parents + labeled BitGo contracts) | 318 + 17 | about 64.7k | **NOT MPC**, exclude |

### Coverage gaps

- Wallet v6 "native MPC receive addresses" (forwarder v5) are plain EOAs with no factory event.
- Base addresses that never created a V4 forwarder are also missed.
- The 91000 heuristic (#2b) partly fills these gaps.

---

## 2b. Transaction-construction fingerprints (tested on known sets)

`tx_profile.py` profiled the last 50 outgoing txs of each address in 8 groups. Output: `raw/profile_summary.txt`, `raw/profile_txs.csv`.

| Group (n addrs / txs) | Plain-ETH-send gasLimit | ERC-20 gasLimit / gasUsed (p10/p50/p90) | Priority fee | Tx type |
|---|---|---|---|---|
| BitGo TSS bases (15 / 745) | **91000** (212 sends; next most common 91211, 91208) | 2.12 / 2.53 / 2.75 | **1.15 x round** (0.0115, 0.00115, 0.0575, 0.115 gwei) | 100% type-2 |
| Coinbase Prime labeled (12 / 573) | **90000** | 3.7 / 5.0 / 8.2 | round (0.1, 0.01, 1, 0.05 gwei) | type-2 |
| Copper labeled (12 / 600) | 21000 | 2.38 / 2.50 / 3.18 | varied; 50 legacy txs | mixed |
| Ceffu labeled (6 / 300) | 50000 / 51000 | 1.5 / 3.5 / 6.9 | 1 / 2 / 0.2 gwei | type-2 |
| Cobo labeled (4 / 173) | 21000 | 1.5 / 3.6 / 3.7 | n/a | **100% legacy type-0** |
| Fireblocks gasless fee payers (15 / 710) | 21000 | 1.008 / 1.008 / 1.013 | 100 wei, 75 wei, … | type-2/4 |
| Celsius "Fireblocks Custody 1" (1 / 50) | 21000 | 1.21 / 1.32 / 1.39 | 1 gwei | type-2 |
| Control: random senders in latest block (19 / 697) | 21000, 210000, 207128, 90000 | 1.008 / 1.19 / 2.18 | 2 / 1 gwei / 100 wei | type-2 |

### Prevalence test

`scan_gaslimit.py` sampled plain ETH transfers:
- 400 blocks at 1-in-25 spacing: 36k transfers.
- 1,500 blocks at 1-in-133 spacing: 118k transfers.

**gasLimit 91000**
- Rare: 79 of 118k.
- 16 distinct senders. 5 are confirmed BitGo-V4 parents. The other 11 share the same 1.15 x priority-fee rounding and ERC-20 ratio of about 2.1 to 2.6. They are probably BitGo MPC wallets without V4 forwarders: **+687 ETH, medium confidence** (`raw/bitgo_gas91000_candidates_enriched.csv`).
- Limitation: plain sends emit no logs, so complete enumeration needs a full block scan or an indexer (Dune/BigQuery). The sample catches only senders active at least weekly.

**gasLimit 90000**
- Common: 3,362 of 118k, from 205 senders, of which only 4 are Coinbase-Prime-labeled. Not usable alone.

**Fireblocks**
- **No usable fingerprint.** The two Fireblocks-attributed groups differ: gas buffer ratio about 1.008 versus about 1.3, and priority fee 100 wei versus 1 gwei.
- The fee-payer profile is indistinguishable from the control group's p10. Fireblocks lets the customer pick fee levels and uses node gas estimates, so defaults are not stable.

**Cobo**
- Legacy-only transactions in 2026 are distinctive. With 4 addresses, that is too few to validate, so it is not used.

### False-positive risk

- 91000: low to moderate. Another wallet SDK could share the default.
- Everything else: high.

---

## 3. Gas-funder ("gas station") fingerprint

### What it is

Custody platforms run shared hot EOAs that send exactly-enough ETH for gas to the EOAs they are about to sign from. Any EOA topped up by a platform's funder is a platform-signed EOA. The funders themselves come from explorer labels ("Deposit Funder", "Gas Supplier").

### Fireblocks

**No shared funder exists.** The Gas Station is a per-workspace internal wallet, funded and configured by each customer ([Fireblocks docs](https://developers.fireblocks.com/docs/work-with-gas-station), [funding](https://developers.fireblocks.com/docs/funding-the-gas-station)). The pattern (threshold/cap top-ups triggered by a deposit to the vault) exists, but the funder differs per customer. Without a seed it cannot be told apart from any exchange's sweeper.

### Coinbase Prime / Coinbase Custody

**This works, and at scale.**

| Funder | Outgoing txs | History enumerated | Recipients | Recipients' ETH | Role |
|---|---|---|---|---|---|
| "Coinbase Prime: Custody Deposit Funder 1" `0xa86309988947559b6e72ef716c5058f479386c0f` | 209k | 2024-02-16 to 2026-10-29, four Blockscout pagination windows | 29,983 | **4.26M** | Fuels the custody **vaults themselves** |
| "Coinbase Prime: Deposit Funder 1" `0x1565f0c4…` | not counted | 2025-09 to 2026-10 | 15,410 | 17.8 | Fuels swept deposit addresses |

Custody funder top-up pattern:
- Top-ups are tiny: the median per recipient is 0.001 ETH, and many are exact gas amounts such as 2.1e-6 ETH.
- 97% of value is in recipients whose median top-up is ≤0.01 ETH.
- All recipients holding ≥1 ETH were code-checked: 2,284, all EOAs.

Cross-checks on the 1,045 recipients holding ≥100 ETH (Blockscout/OLI metadata; untrusted, garbled issuer names):
- 184 are tagged "... ETF" (1.11M ETH). This is consistent with the US spot ETH ETFs using Coinbase Custody.
- 99 are tagged "Beacon Depositor".
- Explicit tags include "Deribit: Coinbase Prime Custody" (161,300 ETH) and "Bitvavo: Coinbase Prime Custody 6".
- 761 have no tag.

Collision check: only 2 addresses also appear in another platform's set (Anchorage sweep destinations).

### Ceffu, Cobo, Copper, Anchorage

`funder_expand.py` sampled 300 recent top-ups per funder:
- Recipients are swept deposit addresses: Cobo 240 holding 0 ETH, Ceffu 289 holding 2.2 ETH. Copper's funders were inactive recently (5 recipients).
- Following the sweeps one hop leads to already-labeled vaults: Cobo → "Cobo: Custody 1", Ceffu → "Ceffu 2", Copper → mostly labeled Copper wallets, adding 4 unlabeled EOAs with 2,933 ETH.
- The sweep-destination hop is noisy: Anchorage-funded deposit addresses also sweep to Coinbase addresses. Treat as medium.
- **Anchorage** uses HSMs, not MPC. It is listed only as a control and is excluded.

### False-positive risk

- Coinbase custody funder recipients: low that they are not Coinbase-controlled. A custodian only pays gas for keys it signs with.
- **MPC status is the open question.** Coinbase's head of cryptography describes Coinbase key protection as MPC-based ([cb-mpc announcement](https://www.coinbase.com/blog/introducing-coinbases-open-source-mpc-cryptography-library), "derived from the MPC engine used at Coinbase to protect asset keys"). In 2026 he discussed an HSM fallback only if post-quantum schemes break MPC ([Decrypt, 2026-09-22](https://decrypt.co/379000/coinbase-playbook-post-quantum-bitcoin-custody)).
- Some third-party comparisons describe Coinbase custody as HSM cold storage, and the Coinbase 10-K describes "cryptographic consensus of multiple human approvers" without naming MPC. **Classify as "probably MPC, unverified"** and keep it separable in any estimate.

---

## 4. Explorer / OLI labels

These are not fingerprints. They come from the Blockscout metadata service (Etherscan-style name tags plus OLI) and serve as seeds and as cross-checks.

| Platform | Labeled EOAs | ETH | Largest |
|---|---|---|---|
| Coinbase Prime | 665 | 174,639 | Deribit: Coinbase Prime Custody 161,300; Bitvavo CB Prime Custody 6: 8,353 |
| Copper | 53 | 87,672 | "Copper: Hot Wallet / Copper 5" 6,275 |
| Ceffu | 17 | 62,621 | "Ceffu: Custody Hot Wallet 2" 52,873 |
| Cobo | 61 | 13,044 | "Cobo Custody 3" 12,049 |
| BitGo | 24, **all contracts** | 57,814 | Not MPC, excluded |
| Fireblocks | 1 ("Celsius: Fireblocks Custody 1") | about 0 | |
| Fordefi, Utila, Dfns | none on EOAs | | |

### Fireblocks seed addresses from public sources

- Celsius (court-disclosed Fireblocks custody, labeled).
- The 65 Universal-Gasless fee payers.

No exchange in the label set is tagged as Fireblocks-held. Fireblocks customers' wallets are labeled under the *customer's* name (e.g. "Exchange X: Hot Wallet"), so the custody platform is invisible in labels too.

### False-positive risk

Label quality varies. Some garbled OLI names were seen. Tags are point-in-time, and some labeled funders (e.g. Cobo Deposit Funders 1/3/4, CB Prime Gas Suppliers 2/3) have 0 transactions on mainnet, probably labels for other chains.

---

## Platform-contract interactions considered and why they are not counted

- **BitGo WalletSimple / Forwarder factories:** used, see #2. They serve exclusion: about 64.7k ETH sits in BitGo multisig contracts, which is not MPC.
- **Cobo Argus / CoboSafe modules:** Safe-based (contract wallets), so not MPC EOAs. Found `CoboSafeFactory` and `CoboSafeModule` labels. Not pursued.
- **Copper ClearLoop, Ceffu MirrorX:** off-exchange settlement mirrors exchange balances off-chain. No mainnet contract a vault EOA calls was found.
- **Fireblocks "FireblocksOmnibus" contracts** (9 verified): tokenization/NFT omnibus contracts from Fireblocks' tokenization engine, not custody. Not used.
- **Staking batch-deposit contracts (Kiln, Figment, Coinbase):** not done in this pass. Two signals suggest it would pay off:
  - 99 large Coinbase-funded vaults are tagged "Beacon Depositor".
  - Some Coinbase-funded vault EOAs send transactions to the EIP-7002 withdrawal-request predeploy (`0x00000961…7002`), so they are validator withdrawal credentials.

  Staked ETH whose 0x01/0x02 withdrawal credentials point at an identified MPC EOA is arguably MPC-held and is **not** included above. This is the main recommended next step.

---

## Totals (current ETH, lower bounds; `data/fingerprint/totals_by_platform.csv`)

| Platform | High-confidence fingerprint | Medium fingerprint | Labels / funder (seeded) | Platform total | MPC status of platform |
|---|---|---|---|---|---|
| Coinbase Prime / Custody | – | 28,942 (sweep destinations, includes a Coinbase exchange hot wallet) | 4,257,240 (custody-funder recipients) + 174,639 (labels) | **about 4,460,800** | probably MPC (company statements), unverified |
| Copper | – | 2,933 | 87,672 | **about 90,600** | MPC (marketed) |
| Ceffu | – | – | 62,623 | **about 62,600** | MPC (marketed) |
| Cobo | – | – | 13,044 | **about 13,000** | MPC + HSM mix |
| BitGo TSS | 6,737 | 687 | – | **about 7,400** | MPC/TSS (wallet v3/5/6) |
| Fireblocks | 0.6 (sample; about 300 extrapolated) | 1,068 (gasless fee payers) | about 0 (Celsius) | **about 1,100 to 1,400** | MPC; **severe undercount** |
| Utila | 90 | – | – | **90** | MPC |
| Dfns | about 0 | 16 | – | **about 16** | MPC |
| Fordefi | – | – | – | **0 (no fingerprint found)** | MPC |
| *Excluded: BitGo multisig contracts* | | | | *about 64,700* | not MPC |
| *Excluded: Anchorage* | | | | *about 14,900* | HSM |

Shares of about 122.2M ETH:
- **All identified: about 4.64M ETH, about 3.8%.**
- Excluding Coinbase: about 175k ETH, about 0.14%.
- Fingerprint-only, no labels or seeded funders: about 9k ETH, under 0.01%.

## Interpretation for the MPC-share estimate

1. On-chain identification is **platform-dependent, not MPC-dependent**. It succeeds where a platform runs shared, labeled infrastructure:
   - a gas funder (Coinbase);
   - a factory contract (BitGo);
   - a 7702 delegate (Fireblocks, Utila, Dfns).

   It fails for the dominant model, a white-label vault in the customer's own workspace (Fireblocks, Fordefi, Utila treasury, Copper vault EOAs that are not labeled).
2. For Fireblocks, the platform most relevant to the MPC-share question, the on-chain lower bound (about 1k ETH) is meaningless as an estimate. Use top-down sources instead: Fireblocks' reported transfer volume and AUC, and exchange proof-of-reserve address lists cross-referenced with exchanges known to custody with Fireblocks.
3. The single largest identifiable MPC-plausible pool is Coinbase custody (about 4.3 to 4.5M ETH in EOAs, plus staked ETH not counted). Whether it enters an "MPC share" depends on accepting Coinbase's own MPC statements.

## Reproduce

```
cd /root/mpc-tracking/scripts/fingerprint
python3 -I harvest_blockscout_tags.py ../../data/fingerprint/raw/blockscout_custody_tags.csv
python3 -I scan_topic.py 0x3eef9492…85ed 19832000 latest ../../data/fingerprint/raw/bitgo_v4_fwdcreated 200000 0x37996e76…f92a
python3 -I scan_topic.py 0xc9793ee4…569c 22431084 latest ../../data/fingerprint/raw/utila_executedcalls 200000
python3 -I collect_type4.py 1500 120 7 ../../data/fingerprint/raw/type4_sample.jsonl
python3 -I funder_recipients.py coinbase_prime 0xa8630998…6c0f 600 out.csv <start_block>
python3 -I fast_balances.py in.csv out.csv 1    # or enrich.py for code + nonce
python3 -I aggregate.py
```