Why have losses continued 5 years after the vulnerable Coldcard firmware was released in 2021?