A hacker who stole a large amount of Solana earlier this year has resurfaced after about five months of quiet. The wallet linked to the Step Finance attack suddenly became active again, and on-chain data shows the attacker moved quickly. They sold all 261,933 SOL they still held, raising around $21.4 million. Then they bridged those funds to the Ethereum network, bought 12,128 ETH, and deposited everything into the privacy protocol Tornado Cash.
This kind of transaction is a classic money laundering move. The goal is to cover up the trail of stolen funds. On the Solana side, the $21.4 million selling pressure was absorbed by the market. Some analysts say the potential risk of a sell-off for Solana investors has been reduced, at least for now.
Why Tornado Cash Matters Here
The most noteworthy part of this story is the transfer to Ethereum and the use of Tornado Cash. Mixing funds through privacy protocols makes it much harder for investigators to trace where the money ends up. It’s a deliberate step to break the chain of transactions.
Back in late January 2026, Step Finance suffered a serious security breach. Hackers gained access to the platform’s treasury and fee wallets by compromising administrative devices. They withdrew roughly 261,854 SOL, which was worth between $27 million and $30 million at the time. The attack caused the STEP token to drop in value by over 80%.
What This Means for Solana Holders
For regular Solana investors, the news might actually offer a bit of relief. The hacker’s large SOL position has now been sold and moved away. The selling pressure that could have hit the market is gone, at least from this source. But it’s worth remembering that this is a reminder of how vulnerable DeFi platforms can be, and how quickly stolen funds can change shape and disappear.
As for law enforcement, tracking the money just got a lot harder. Tornado Cash has been used for such purposes before, and its decentralized nature makes it tough to regulate or intercept. Whether authorities can follow the trail remains to be seen.
This is not investment advice.
