A critical vulnerability in the firmware of Coldcard hardware wallets has led to the theft of approximately 594 bitcoin, worth about $38 million, from around 500 user wallets.