A five-year-old Coldcard firmware bug let an attacker guess bitcoin seed phrases and drain 1,816 BTC from 5,200 addresses.