The hackers have moved a portion of the stolen funds to the MEXC exchange and bridged funds to Ethereum and Bitcoin.