ChainCatcher message, according to the monitoring by Yu Xian, the founder of Slow Mist Technology, starting from 2:48 AM, the DEXX attackers have successively exchanged a batch of tokens from related EVM (ETH/BASE/BSC) addresses for the corresponding ETH/BNB.

The exchanges are still ongoing, and these ETH/BNB have not been transferred out yet (though some relevant tests have been discovered).