The wallet tied to the Step Finance breach has sprung back to life after roughly five months of dormancy. On-chain data reveals the attacker offloaded the entire stash of 261,933 SOL, netting approximately $21.4 million. The proceeds were immediately bridged to Ethereum, swapped for 12,128 ETH, and funneled into the privacy protocol Tornado Cash.
This pattern mirrors classic money-laundering technique, designed to sever the transaction trail. On the Solana side, the sell pressure was absorbed by the market, and analysts note the overhang risk for SOL investors has now dissipated—at least from this source.
The original hack occurred in late January 2026, when attackers compromised administrative devices at Step Finance, draining treasury and fee wallets of roughly 261,854 SOL (then valued at $27–30 million). The breach cratered the STEP token by over 80%. The latest move shifts the focus to Ethereum, where the use of Tornado Cash complicates any effort by authorities to trace the funds, underscoring persistent vulnerabilities in DeFi security.
