Thousands of accounts were hacked and more than $140 million in bitcoin was stolen after a flaw was revealed in security devices sold by a Canada-based company.