What's worse than a thief who breaks into your vault?  A thief who was handed the key.  That's the reality for thousands of Bitcoin holders who trusted their savings to Coinkite's Coldcard hardware wallets.  A "days-long" active attack has exploited a catastrophic bug