Bitcoin cold-wallet attack spreads to 4,500 addresses as losses near $89 million