The suspected Coldcard exploit continued expanding as investigators link more wallets and Bitcoin to the broader attack.