Exploiting a 2021 firmware flaw that compromised seed phrase randomness, attackers have drained over 1,800 BTC from Coldcard hardware wallets, pushing total losses past $114 million across multiple attack waves.