Across all attack waves, 82% of stolen coins remain in attacker-controlled addresses, while 18% have been moved for laundering.