The Laundering Process
Published 7/5/2026, 10:49:46 AM
The Step Finance exploiter successfully moved $21.4 million through Tornado Cash by executing a multi-stage cross-chain laundering operation that leveraged the privacy protocol's ability to sever on-chain links between deposits and withdrawals. While the initial movement of funds was flagged by analytics firms, the use of zero-knowledge proofs and third-party relayers effectively rendered the final destination of the funds untraceable [Source: https://cryptobriefing.com/step-finance-exploiter-launders-funds-tornado-cash/].
The Laundering Process
The attacker followed a systematic path to move the stolen assets from the Solana network to the Ethereum-based mixing protocol:
- Asset Liquidation: Following the initial theft of approximately 261,854 SOL (valued at $27M–$30M) on January 31, 2026, the attacker waited several weeks before selling a portion of the SOL for $21.4 million in liquid assets [Source: https://www.kucoin.com/news/flash/step-finance-attacker-sells-261-933-sol-for-21-4m-converts-to-12-128-eth].
- Cross-Chain Bridging: The funds were bridged from Solana to Ethereum, adding a layer of complexity that can often bypass simpler automated tracking tools [Source: https://rekt.news/step-finance-rekt].
- ETH Conversion: Once on Ethereum, the attacker converted the $21.4 million into 12,128 ETH [Source: https://www.kucoin.com/news/flash/step-finance-attacker-sells-261-933-sol-for-21-4m-converts-to-12-128-eth].
- Tornado Cash Mixing: The full 12,128 ETH was deposited into Tornado Cash, placing the funds into a shared liquidity pool to break the link between the deposit and subsequent withdrawals [Source: https://cryptobriefing.com/step-finance-exploiter-launders-funds-tornado-cash/].
How the Movement Remained "Undetected"
Although the act of depositing into Tornado Cash was visible, the attacker remained "undetected" in terms of fund recovery and identity through several strategic choices:
- Anonymity Sets: By using Tornado Cash’s zk-SNARKs (zero-knowledge proofs), the attacker could prove they had a valid deposit without revealing which specific deposit was theirs. The large volume of ETH in the pool provided a massive "anonymity set" to hide within [Source: https://cryptobriefing.com/step-finance-exploiter-launders-funds-tornado-cash/].
- Strategic Timing: The attacker waited until late February 2026 to move the funds, allowing the initial high-intensity monitoring of the exploiter's wallets to subside [Source: https://rekt.news/step-finance-rekt].
- Relayer Usage: The attacker likely used third-party relayers to pay for gas on withdrawal. This allowed them to withdraw the mixed ETH to entirely fresh wallets that had no prior on-chain history or ETH for gas, further obscuring the trail [Source: https://cryptobriefing.com/step-finance-exploiter-launders-funds-tornado-cash/].
Incident Summary
| Metric | Details |
|---|---|
| Total Stolen | ~261,854 SOL ($27M - $30M) [Source: https://rekt.news/step-finance-rekt] |
| Amount Laundered | $21.4 Million (12,128 ETH) [Source: https://www.kucoin.com/news/flash/step-finance-attacker-sells-261-933-sol-for-21-4m-converts-to-12-128-eth] |
| Primary Tool | Tornado Cash (Ethereum) [Source: https://cryptobriefing.com/step-finance-exploiter-launders-funds-tornado-cash/] |
| Exploit Vector | Compromised executive devices (Phishing/Social Engineering) [Source: https://rekt.news/step-finance-rekt] |
| Current Status | Step Finance ceased operations on February 24, 2026 [Source: https://therecord.media/step-finance-cryptocurrency-theft-shutdown] |
Following the exploit, Step Finance, SolanaFloor, and Remora Markets all announced shutdowns in late February 2026 [Source: https://www.tradingview.com/news/invezz:427a3a1a2094b:0-solana-defi-platform-step-finance-shuts-down-after-hack/]. Step Finance is reportedly working on a buyback for STEP token holders based on a snapshot taken prior to the incident [Source: https://www.coindesk.com/business/2026/02/24/step-finance-shuts-operations-after-usd27-million-january-hack].