The attacker behind the third wave of thefts from Coldcard hardware wallets has moved 97.09 BTC, roughly 45% of that wave's haul and about $7.7 million at Monday's prices, according to Galaxy Research. The first exit came on September 2, when around 20.5 BTC from the largest vault went through THORChain and came out as Ethereum. The coins spent on Sunday night went into CoinJoin rounds instead, a Bitcoin privacy technique that pools transactions from multiple users to break the trail between inputs and outputs. Only 20.56 BTC actually reached Ethereum. Another 57.24 BTC is sitting unspent as CoinJoin change in a single address, and Galaxy says its trail ends on roughly 19 BTC more.