"This morning, through monitoring, we found that all kinds of tokens on the Solana address related to the DEXX attacker have been exchanged for SOL in large quantities since about 3 a.m., and these SOLs have not been transferred out yet," Yuyu, the founder of Slow Mist, said in a post.