Bitcoin linked to the third wave of the Coldcard wallet theft has begun moving through THORChain into Ethereum, marking the first reported transfer of funds from the incident. Galaxy Research's Alex Thorn said about 10% of the stolen BTC had moved while the remaining 90% was still untouched. Several THORChain transactions were returned and retried, and researchers traced the swaps to a new Ethereum address whose details were shared with authorities and crypto companies. Galaxy Research said the broader Coldcard exploit affected 8,865 addresses and caused losses of at least 1,789 BTC, worth about $115 million at the time of the theft. Earlier Bitquery tracking identified 20.69 BTC across 36 swaps, including 20.45 BTC moved through 34 swaps on September 2 and 3, while more than 1,400 BTC remained in identified theft-linked addresses.