whitehat hacking a protocol is a thing see the DAO hack on Ethereum, also other projects it happens since patching allows bad actors to know what is vulnerable Sadly I doubt that is what happened with coldcard

They should if they know how

Safu's puppeteers, like FTX's Bankman-Fried, control the purse strings, don't they?

then how what do you do with the funds?