The movement pattern is the interesting part here. Sending stolen funds through THORChain to Ethereum, then into coinjoins, means the exploiter is deliberately breaking the chain-analysis trail across chains, not just within Bitcoin.

The 2-of-2 multisig detail from wave 3 is worth paying attention to. That was not a simple wallet compromise, the victims were walked into signing something they did not fully understand, or the second key was controlled from the start. Coldcard hardware itself was never the weak point, the signing flow was.

For anyone tracking this, the coinjoin step usually means the next move is consolidation, not exit. Once the coins are mixed, you stop seeing clean input output links, but you also start seeing smaller wallets lighting up weeks later. Chain surveillance gets harder, not impossible, once you know the timing and the amounts.