Slow Fog's cosine at X stated: "We checked the surveillance early in the morning, and it started around 3 AM. Various tokens related to the DEXX attackers were being exchanged in large quantities for SOL on the Solana addresses, and currently, these SOL have not been transferred out yet."