Full timeline of the DEXX theft and the latest developments

Author: Hella | Wonder Woman; Source: X@hella1413

It has been 15 days since the DEXX theft. As a victim and the leader of the rights protection group, I have sorted out the complete timeline of the incident and the latest developments:

1. Key time nodes:

[Early morning of November 16] - The theft occurred

DEXX suffered a large-scale asset theft. According to incomplete statistics from SlowMist, the total loss was 21 million USDT, the number of victims exceeded 1,000, and more than 8,000 stolen addresses were involved.

[November 16, 6:00] - Establish a rights protection group

Users spontaneously established a rights protection group (as one of the group leaders, I organized 3,500 people and a large group), and began to organize the collection of victim information, including helping to connect with SlowMist to monitor the flow of stolen funds.

[November 19] - The platform reported the case to the police and filed a case, and cooperated with SlowMist to investigate

The platform has filed a case, and SlowMist has also stated that it has officially intervened and will cooperate with law enforcement agencies in subsequent investigations.

[November 20] - Victims reported to the police in many places and filed cases

Since the day of the incident, victims from all over the country have reported to the police and successfully filed cases. According to incomplete statistics, there have been dozens of case filing receipts so far, and GA departments in many places across the country are intervening.

[November 24, 3 am] - The attacker sold the stolen assets for the first time

According to a large number of user feedback and SlowMist monitoring, the attacker converted a large number of tokens on the Solana address into Sol, but has not yet transferred them out.

[November 25] - The victims' community speaks out

I wrote an open letter "calling on the DEXX platform to take responsibility and recover user losses", which received support from various big Vs. As of now, the post has been read 620,000 times, promoting the exposure of the incident.

[November 28] - Roy publicly stated that compensation would be given

Founder Roy said that he was in talks with investment institutions and discussed with security experts to build a platform security upgrade plan; and determined that the compensation path was to develop a new entrance on the platform and pay the compensation to a new address. Before this, Roy had also stated that he would compensate the victims in full.

[November 28] - The attacker's Solana address has been basically confirmed

SlowMist released a list of Solana chain addresses containing 8,612 attackers (some victims counted some tokens according to the program, including 65,600 Sol, 3.4 million Ban, 510,000 Luce1, and 1.5 million Shoggoth), and prompted timely feedback if there were false positives or omissions. It also emphasized that the data of the EVM chain still needs to wait patiently for a few days before the investigation is completed.

[Early morning of November 29] - The attacker's EVM address began to show abnormal test

According to SlowMist monitoring, the attacker's EVM address (ETH/BSC/BASE) showed abnormal test, but there has been no large-scale abnormal change.

[November 29, 19:00] - Du Jun expressed his intention to acquire

ABCDE Labs founder Du Jun said on Twitter that he was communicating with the platform about the acquisition plan and asked users "whether they would continue to use it if full compensation and security upgrades are made."

[November 30, 3:00] - The attacker exchanged a batch of EVM chain tokens into ETH/BNB, but has not yet transferred them out.

II. Latest progress:

Asset flow: The attacker exchanged multiple on-chain assets into Sol/ETH/BNB, but has not yet transferred them out. The attacker address of the Solana chain has been basically determined, but the data of the EVM chain is still being cleaned.

Compensation plan:The platform said that it would have to wait until SlowMist had collected the data before formulating a compensation plan.

Current action focus: The victim should continue to BJ and must use legal weapons to protect his legal rights and interests. At the same time, we also call on all parties to continue to pay attention. Until the incident is perfectly resolved. I will also continue to pay attention and keep updating the progress in a timely manner!

If there is any error, please contact me to correct it. Thank you for your support.