[CodesInChaos]

> but the fact that there are three waves in the attack shows the level of coordination and pre-planning that was involved in making it happen.

That's a strange interpretation. If it was planned well, why weren't all affected addresses drained as quickly as possible? I would have continuously emptied all vulnerable addresses, from highest to lowest without taking a break in the middle.

> Instead of picking the lowest cost option, the attacker appears to be prioritizing speed in an apparent move to make themselves as untraceable as possible.

I don't see how higher fees would make the attacker less traceable. If anything, the unusually high fees stand out. Though in the long run defenders will enumerate all the vulnerable source addresses anyway, so the affected coins are inherently traceable (at least until laundered).

More likely they prioritized speed to beat other attackers, now that the vulnerability is public. No matter if this was the original attacker or a competitor.