The Coldcard vulnerability was located in a complex code base that involved hopping between different repositories and programming languages