Exploit and Laundering Workflow
Published 7/5/2026, 3:31:01 PM
The Step Finance hacker converted stolen SOL into ETH through a multi-stage process involving centralized liquidation, cross-chain bridging, and decentralized mixing. The operation, which concluded in July 2026, successfully laundered approximately 12,128 ETH (valued at ~$21.4 million at the time) through Tornado Cash [Source: https://cryptobriefing.com/step-finance-exploiter-launders-funds/].
Exploit and Laundering Workflow
The laundering process followed a structured path to move assets from the Solana ecosystem to Ethereum-based privacy protocols:
| Phase | Action | Details |
|---|---|---|
| 1. Initial Theft | Asset Drainage | 261,854 SOL stolen from compromised treasury and fee wallets via an operational breach (phishing/social engineering) [Source: https://halborn.com/explained-step-finance-hack-january-2026/]. |
| 2. Liquidation | SOL to Stablecoins | The attacker sold ~261,933 SOL on Solana markets for $21.4 million in stablecoins [Source: https://cryptobriefing.com/step-finance-exploiter-launders-funds/]. |
| 3. Bridging | Cross-Chain Transfer | The $21.4 million was moved from Solana to the Ethereum network [Note: specific bridge protocol not independently confirmed]. |
| 4. Conversion | ETH Acquisition | Bridged funds were used to purchase 12,128 ETH at an average price of ~$1,765 [Source: https://cryptobriefing.com/step-finance-exploiter-launders-funds/]. |
| 5. Laundering | Tornado Cash | 100% of the 12,128 ETH was deposited into Tornado Cash mixing contracts to obfuscate the transaction trail [Source: https://cryptobriefing.com/step-finance-exploiter-launders-funds/]. |
Technical and Operational Context
- Exploit Vector: The hack was not a smart contract failure but an "operational vulnerability." Attackers gained access to private keys by compromising the devices of executive team members [Source: https://halborn.com/explained-step-finance-hack-january-2026/].
- Dormancy Period: The attacker remained inactive for five months following the January 31, 2026, theft before initiating the laundering sequence in July 2026.
- Recovery and Impact: Only $4.7 million (12%) of the total $40 million loss was recovered, primarily through Solana's Token22 extensions [Source: https://valuethemarkets.com/step-finance-crypto-heist-takeaways/]. The exploit led to the permanent shutdown of Step Finance, SolanaFloor, and Remora Markets in late February 2026 [Source: https://crypto.news/solana-based-step-finance-shuts-down-after-40m-hack/].
Current Status
As of July 2026, the funds have been fully processed through Tornado Cash. While the project has ceased operations, the laundering event highlights the continued use of Ethereum's privacy infrastructure for large-scale asset obfuscation despite ongoing regulatory sanctions against the mixing protocol.