The founder of Slow Fog, Yu Xian, stated in a post on X that starting at 2:48 AM, the DEXX attackers began to successively exchange tokens from a batch of EVM (ETH/BASE/BSC) addresses related to the attackers for the corresponding ETH/BNB. The exchanges are still ongoing, and it seems that another script has been written to automate these exchange operations. These ETH/BNB have not yet been withdrawn (although related tests have been discovered).