The Coldcard Wave 3 attacker has moved stolen funds for the first time, with part of the assets swapped into ETH through THORChain, according to Galaxy Digital Head of Research Alex Thorn. The transfers mark the first known movement of funds from the original wallet addresses tied to the Wave 1, Wave 2, or Wave 3 attacks. On-chain data shows roughly 90% of the stolen Wave 3 funds remain unmoved. Activity also indicates the attacker faced issues while using THORChain, with some swap transactions repeatedly refunded, though attempts to convert the remaining funds are ongoing.