A critical security vulnerability affecting the recovery phrase generation of certain cryptocurrency software wallets has led to the theft of at least $5 million and continues to pose a widespread risk.