Analysts at Galaxy Research have detected the transfer of bitcoins stolen during the third wave of attacks on Coldcard users. The hacker moved the assets into the CoinJoin mixer, which complicates tracking by combining payments from multiple participants. Previously, the perpetrator converted the coins into Ethereum through THORChain.
