Attackers exploited weak Coldcard recovery phrases to steal over $100 million in Bitcoin across thousands of wallet addresses in multiple attack waves beginning in late July 2026.