Galaxy researchers tracking the COLDCARD Wave 3 incident say the attacker has moved the stolen funds for the first time and converted some of them to ETH through THORChain’s cross-chain decentralized exchange.

ChainCatcher adds that this marks the first on-chain transfer from the original hacker addresses linked to Waves 1, 2, or 3.