A firmware vulnerability in Coinkite's Coldcard wallets allowed attackers to remotely deduce security data and drain approximately $130 million in bitcoin without accessing the physical devices, triggering a surge of inflows into regulated ETFs.