The cold wallet maker said the flaw behind roughly $114 million in losses remains live, with specific models and firmware still exposed.