The Coldcard exploiter moved about 10% of stolen funds through THORChain, as researchers traced the assets to a new Ethereum address.