A hacker linked to the third wave of thefts from Coldcard wallets has started converting stolen bitcoins into Ethereum via THORChain, according to Alex Thorn, head of research at Galaxy. He indicated that approximately 10% of the stolen funds have been moved, while the remaining 90% are still held at the original addresses.
Previously, Galaxy had connected the attack to the theft of at least 1,789 BTC from 8,865 addresses. Thorn pointed out that this marks the first movement of funds from the hacker's original addresses during this third wave.