Galaxy Research said the attacker behind Coldcard’s third theft wave moved 45% of their haul through THORChain or into CoinJoin transactions.