The founder of Slow Mist, Cosine Yu X, said in a post that since 2:48 am, the DEXX attackers have one after another exchanged the tokens on a batch of EVM (ETH/BASE/BSC) addresses related to the attackers for the corresponding ETH/BNB. The exchange is still going on. It should be that another script has been written to automatically do these exchange operations, and these ETH/BNB have not been transferred out yet (but relevant tests have been found).