The operator behind the so-called Wave 3 cluster of Coldcard hardware-wallet thefts has begun systematically cashing out stolen bitcoin after weeks of inactivity, according to a Monday update from Galaxy Research.