RWA Galaxy Research reports that the attacker behind the Coldcard thefts has moved $7.7 million in Bitcoin, now draining the 11 largest vaults tied to the third wave of attacks. This represents 45% of the total stolen in this wave, highlighting ongoing security vulnerabilities in hardware wallets.