According to PANews, Yu Xian, the founder of Slow Mist Technology, monitored that starting at 2:48 AM in the UTC+8 time zone, the DEXX attackers began exchanging tokens on EVM (ETH/BASE/BSC) addresses for ETH/BNB. The exchange is still ongoing, and these ETH/BNB have not yet been transferred out.