SAN FRANCISCO, Aug. 4 -- Jonathan Goodman did everything right. He kept his Coldcard wallet offline. He never shared his seed phrase with anyone. He stored his Bitcoin on a hardware device specifically designed to make digital theft impossible. On Monday, someone emptied his account anyway, taking $1.6 million.

Goodman is one of dozens of victims in a breach that researchers at Block and analytics firm Elliptic say has cost Coldcard users more than $130 million. At least twelve distinct hacking groups have been involved, according to Galaxy Research. The flaw they exploited was not in how victims behaved. It was in how Coldcard manufactured its devices.

Coldcard, made by the Toronto-based company Coinkite, occupies a particular place in...