BlockBeats News, September 3rd, Galaxy Digital Research Director Alex Thorn stated that the Coldcard Wave 3 attacker recently made the first transfer of stolen funds and exchanged some of the assets for ETH through the cross-chain decentralized exchange platform THORChain. This is the first time in the Wave 1, Wave 2, or Wave 3 attack events that funds have been moved from the attacker's original wallet address to other addresses on-chain.

Currently, approximately 90% of the stolen funds from Wave 3 have not yet been transferred. On-chain activities show that the attacker encountered some issues when exchanging funds through THORChain, with some transactions being repeatedly refunded. However, the attacker is still attempting to exchange the remaining funds.