Millions of dollars have been stolen from more than 5,000 wallets. The exploit appears to affect users of hot wallets