Galaxy research head Alex Thorn said the exploiter linked to the third wave of Coldcard thefts has started moving stolen Bitcoin for the first time, swapping part of the funds into Ether through THORChain.