Onchain investigators followed part of the Coldcard third-wave haul into Ether as repeated THORChain swaps left most stolen funds parked.