A Coldcard Wave 3 operator moved about 20.5 BTC into Ether through THORChain, the first spend from the original addresses across three attack waves.
TRM Labs traced roughly 1,816 Bitcoin, worth about $116 million at its August 5 snapshot, from more than 5,200 addresses in four Coldcard-related attack waves.
Galaxy Research's August 4 update put confirmed Coldcard-related thefts at 1,596 BTC from about 7,300 addresses, while a separate suspected fourth wave could lift the estimate further.