The attacker has now drained the 11 largest vaults tied to the third wave of Coldcard thefts, Galaxy Research said.