A hacker who stole a large amount of Solana earlier this year has resurfaced after about five months of silence. The wallet linked to the Step Finance attack suddenly became active again and on-chain data shows the attacker moved quickly. They sold the 261,933 SOLs they still held, raising approximately $21.4 million. Then, they transferred these funds to the Ethereum network, purchased 12,128 ETH, and deposited it all into the Tornado Cash privacy protocol.
This type of transaction is a classic act of money laundering. The objective is to conceal the trace of the stolen funds. On the Solana side, the $21.4 million selling pressure was absorbed by the market. Some analysts say the potential sell-off risk for Solana investors has been reduced, at least for now.
Why Tornado Cash is important here
The most notable part of this story is the transfer to Ethereum and the use of Tornado Cash. Mixing funds through confidentiality protocols makes it much harder for investigators to trace where the money ends up. This is a deliberate measure aimed at breaking the chain of transactions.
At the end of January 2026, Step Finance suffered a serious security breach. The hackers gained access to the platform’s treasury and fee wallets by compromising administrative systems. They withdrew approximately 261,854 SOL, which at the time was worth between $27 million and $30 million. The attack caused the value of the STEP token to drop by more than 80%.
What this means for Solana holders
For regular Solana investors, the news might actually offer some relief. The hacker’s large SOL position has now been sold and moved. The selling pressure that could have hit the market has disappeared, at least from this source. But it’s worth remembering that it’s a reminder of how vulnerable DeFi platforms can be, and how quickly stolen funds can change shape and disappear.
As for law enforcement, tracking money has become much more difficult. Tornado Cash has been used for such purposes before, and its decentralized nature makes it difficult to regulate or intercept. It remains to be seen whether the authorities will be able to follow the trail.
This is not investment advice.
