Since they already have it up on their website, you'll probably want to get in touch with a copyright lawyer. I wouldn't do anything before that as you want that transaction trail in place. Screenshot and archive (even internet archive) everything.
If that sounds like it's going to be too expensive an endeavor, I completely understand. If the pirate is selling the asset on his own site, you can probably report that to Google. If he's selling it on a third party site like TurboSquid, you can probably get in touch with them instead. None of this will stop him completely, especially in the future. But my top suggestion would be to remove anything from the Q&A about hacking or pirating or anti-cheat, as this kind of stuff just inspires people to try.
After that you will probably want to think about somehow switching to a one-time licensing key system, rather than a pay-for-download system, for future versions, and distributing the asset for free with a paid license to unlock more features.