A hardware wallet randomness bug turned “impossible to guess” seeds into guessable ones, and $38 million is already gone.