A Coldcard Wave 3 operator moved about 20.5 BTC into Ether through THORChain, the first spend from the original addresses across three attack waves.