Separately, an attacker converted stolen Bitcoin into about 200 Ether through THORChain before sending the funds, valued at roughly $380,000, to Tornado Cash on Wednesday. The Coldcard exploit drained at least $100 million in Bitcoin across three confirmed attack waves involving about 7,300 victim wallets. Blockchain tracing showed that most of the stolen assets remain concentrated in a limited number of attacker-controlled addresses. The concentration of most stolen assets in a small group of visible addresses gives investigators a window to track future movements. That case showed how stolen funds can generate revenue for the protocols used to move them.