RWA According to Galaxy, the exploiter behind the ‘Wave 3’ attacks on Coldcard hardware wallets has moved 45% of the stolen funds, indicating ongoing control over the assets. The movement suggests potential laundering or consolidation, raising concerns among affected users and the broader crypto community.