Coldcard’s Wave 3 attacker moved 97.09 BTC through THORChain and CoinJoin, roughly 45% of that wave, while most stolen funds remain parked.