pull down to refresh
Well, they are complaining about it on Reddit anyway as you can see on OPs post.
In german we have a saying "Gelegenheit macht Diebe" which basically means that sometimes it's the opportunity to steal which turns people into thieves. This is basically what happens when you create a new wallet and find somebody elses. You stubled accidentally into the opportunity.
User error, blocked.
This is what I have never understood. Hearing out users, especially when they are paying customers, is important and there is nothing to lose, not even real significant time. If they turn aggressive, just wait a bit with response or even skip response, but the signal is always worth incorporating, even if it is just "you stole my coin you piece of shit" - even that is a datapoint.
Certainly possible, would think that less likely though given the volume of those is probably still only in the thousands to tens of thousands.
You could generate more seeds on a clunky old laptop in a day then all the seeds ever generated by a ColdCard combined... and people run collider scripts on much more powerful boxes than that constantly.
Since the entropy was so low you wouldn't need to know about the vulnerability specifically, just a naive collider script would get lucky once in awhile.
Knowing the vulnerability just ups the success rate. You can mine weak seeds just as you mine blocks.
Attackers in 2022 may not even know they were Coldcard seeds, just generally weak seeds.