The wallet associated with the Step Finance attack has become active again after approximately five months of inactivity.
According to on-chain data, the attacker sold all of their 261,933 SOL, generating approximately $21.4 million. They then bridged these funds to the Ethereum network, purchased 12,128 ETH, and deposited the assets into the privacy protocol Tornado Cash.
This transaction is considered a classic money laundering tactic aimed at covering up the trail of funds obtained from the attack. On the SOL side, it is stated that the $21.4 million in selling pressure was absorbed by the market and the potential risk of a sell-off for Solana investors has been eliminated.
However, the most noteworthy point was the transfer of funds to the Ethereum network and their conversion to Tornado Cash. This move is expected to make tracking the assets more difficult.
In late January 2026, Step Finance suffered a devastating security breach when hackers gained access to the platform’s treasury and fee wallets by taking over administrative devices. The attackers withdrew approximately 261,854 SOL, initially worth between $27 and $30 million, causing the value of the STEP token to drop by over 80%.
