A critical vulnerability in Coldcard hardware wallets—a code bug hidden for 5 years since March 2021—enabled attackers to brute-force weak random seed generation (40–72 bits entropy vs. required 128 bits), allowing them to steal ~1,800 BTC ($115M) from 5,200+ wallets offline and even in bank vaults. The attacks occurred in four waves from July 30–August 3, with the most sophisticated batch processed at 13.8 transactions per block. This exposes a critical flaw in the assumption that offline storage alone guarantees security—the underlying mathematics must be sound. Key lesson for SMEs: hardware wallet security depends not just on isolation but on cryptographically sound random number generation and transparency in security disclosures.