COLDCARD Wave 3 Attacker Moves Stolen Funds via THORChain

According to Galaxy Digital research head Alex Thorn, the attacker behind the COLDCARD Wave 3 incident has moved stolen funds for the first time, swapping a portion into Ethereum using the decentralized cross-chain exchange THORChain. This marks the first on-chain movement of funds from the original attacker addresses across all three waves. Approximately 90% of the Wave 3 stolen funds remain stationary. On-chain analysis suggests the use of 2-of-2 multisig structures for the vaults and transit addresses, with evidence indicating that different software too