The attacker behind COLDCARD Wave 3 has moved stolen funds for the first time and swapped them for ETH through THORChain, a cross-chain DEX. According to Odaily, this is the first on-chain transfer from the original hacker address involving funds from Wave 1, 2, or 3.