Attackers reconstructed weak Coldcard recovery phrases to access wallets, but users with strong, unique passphrases were protected from the Coldcard attacks