Coldcard attack funds have moved on-chain for the first time, with the wave 3 exploiter swapping stolen assets into ETH via THORChain. Alex Thorn said it marks the first transfer from the original hacker addresses across waves 1, 2 or 3.