A Coldcard attacker moved about 10% of stolen Bitcoin through THORChain into ETH as researchers traced a new Ethereum destination.