Most of the Bitcoin stolen through the COLDCARD wallet flaw remains unmoved, but on-chain investigators have detected a separate attacker beginning to route smaller amounts through a mixer.