Coinkite, maker of the Coldcard hardware wallet, says $38M was drained after an attacker likely used AI to review old open source firmware and found a build error affecting seed generation. Open source was supposed to mean many eyes make bugs shallow. Nobody said whose eyes, or how many, or how fast. A wallet's whole job is to hold the private key away from anything networked; if the flaw was in firmware, the isolation was decorative.