Hackers steal over $130M by exploiting bug in offline hardware wallets