According to Odaily, the DEXX attacker is actively consolidating stolen funds on the Solana blockchain. These funds are being gathered into a central address before being split and laundered. Some of these assets are now being transferred to Ethereum using the Wormhole cross-chain service, with the destination address beginning with 0xffe224e