ChainCatcher message, according to MistTrack monitoring, so far, DEXX attackers have transferred over 4700 ETH to Tornado Cash.

ChainCatcher message, Slow Mist confirmed on X that the DEXX attackers are consolidating the stolen funds from the decentralized platform on Solana, and are splitting them out from the consolidation address for laundering. Some of these have started using the Wormhole cross-chain service to transfer assets to Ethereum addresses starting with 0xffe224e.

ChainCatcher news, according to monitoring by Yu Xian, the founder of Slow Mist Technology, starting at 2:48 AM, DEXX attackers have been gradually exchanging tokens from a batch of EVM (ETH/BASE/BSC) addresses related to the attackers for corresponding ETH/BNB.The exchange is still ongoing, and these ETH/BNB have not been withdrawn yet (although related tests have been discovered).

ChainCatcher news, Slow Mist founder Yu Xian posted on X that early this morning, various valuable tokens on the Solana address related to the DEXX attacker were exchanged for SOL. Currently, these SOL have not been transferred out yet. Additionally, the attacker's EVM (ETH/BSC/BASE) addresses have begun to show signs of unusual activity, but there has not been a large-scale movement yet.

ChainCatcher news, Slow Mist founder Yu Xian posted on X that early this morning, various valuable tokens related to the DEXX attacker’s Solana address were exchanged for SOL, and currently, these SOL have not been transferred out yet.In addition, the attacker’s EVM (ETH/BSC/BASE) addresses have begun to show signs of activity testing, but there has not been large-scale movement yet.

ChainCatcher message, Slow Mist disclosed on platform X that the DEXX attacker started testing the token exchange for ETH on the EVM chain half an hour ago.

ChainCatcher message, Slow Mist released the list of DEXX attacker addresses, indicating that 8,612 addresses have been identified on the Solana blockchain, with data coming from DEXX officials and reports from thousands of victims. As for the EVM chains, they are still in the process of cleaning and compiling statistics, which are expected to be ready in the coming days.

ChainCatcher message, Slow Mist Yu X posted: "Early this morning, the DEXX attacker continued to exchange various value tokens on another batch of Solana addresses for SOL, and has not transferred them out yet. In addition, the attacker's EVM address has not shown any movement for the time being."

ChainCatcher message, Slow Mist founder Yu Xian posted on X, "This morning through monitoring, it was found that starting around 3 AM, various tokens related to the DEXX attacker on the Solana address were exchanged in large quantities for SOL, and currently these SOL have not been transferred out."

ChainCatcher message, Slow Mist founder Yu Xian posted an update on the DEXX incident on social media, stating that Slow Mist has received nearly 500 requests for information regarding the DEXX theft. The incident analysis is still ongoing, and the preliminary assessment indicates a loss in the tens of millions of dollars (due to significant price fluctuations of some meme coins). Almost every victim corresponds to a different attacker address, indicating that the attackers had been planning this incident for a long time. The source of the gas was exchanged through XMR three days ago.