A hardware wallet called Coldcard, made by Coinkite, shipped a firmware bug. Galaxy Research says 1,196 addresses lost 1,082.65 bitcoin in a 41-minute window, before any advisory went out. Coinkite's co-founder says a hotfix removes the bad fallback path but seeds already generated on the flawed firmware stay exposed; users are told to move to new seeds. The window matters more than the total. Whoever found this had it quietly for months, most likely, then spent it fast once they judged detection was close. That is the incentive a silent bug always creates: patience, then a sprint.