New York4,585 offline wallets were drained without going online.
Galaxy Research traced three sweeps of Coldcard-generated keys but says the blockchain cannot show whether one attacker or several are behind them.
Predictable key generation, not device theft, is the suspected flaw; the vendor has not confirmed a cause.
Sources: CoinDesk