Step Finance’s compromised wallet resurfaced after roughly five months of inactivity, signaling the final phase of the 2026 security breach. The attacker liquidated the entire holding of 261,933 $SOL, netting about $21.4 million, and immediately moved the proceeds across chains.
Cross‑Chain Transfer and Laundering Strategy
After the $SOL sale, the hacker bridged the dollars to the Ethereum network, where the funds were exchanged for 12,128 ETH. The newly acquired ether was subsequently funneled into the privacy‑enhancing protocol Tornado Cash, a maneuver commonly used to obscure the origin of illicit crypto assets.
Market Response and Investor Outlook
Analysts observed that the $21.4 million worth of SOL selling pressure was fully absorbed by the market, eliminating any immediate risk of a cascade sell‑off for Solana investors. This absorption helped stabilize the $SOL price and reassured blockchain participants that the liquidity shock had been mitigated.
Aftermath of the January 2026 Breach
In late January 2026, hackers seized control of Step Finance’s administrative devices, extracting roughly 261,854 $SOL—valued between $27 million and $30 million at the time. The theft triggered a sharp decline in the STEP token, slashing its price by more than 80 percent and prompting widespread concern among crypto investors.