A firmware randomness flaw in Coldcard wallets is linked to a 41-minute sweep that drained more than $70M in Bitcoin.