How a bug in Coldcard’s code went unnoticed for years, leading to $100 million in hacked funds