Community tracking indicated that part of the Base exploit proceeds began bridging to Ethereum through Lido infrastructure.

verified span

“Unverified community tracking has pointed to part of the proceeds beginning a bridge to Ethereum through Lido infrastructure, a process that typically takes several days.”