Coldcard Mk3 security advisory: seeds from firmware 4.0.1 onward may be at risk (blog.coinkite.com)

72 bits is a nasty surprise. Testing with a small transaction first is good advice.

This is a big issue and more then 500 ₿ has been stolen already.

Makes me wonder why not a lot more was stolen?

Is the thief under the impression there will be a fork to retrieve stolen coins (2016 Ethereum style)?

I think the chance of that happening is very low so why not steal more?

Was this intended to simply rock the boat and make people aware?

If that benign reason is true then it could even be so that some % of stolen funds will be returned in good time.

Could also be it remains stolen (“finders fee” sort of nonsense).