I didn’t expect the hacker to wait this long. Five months of silence after the Step Finance exploit — that’s not patience. That’s strategy. When the first on-chain movement hit my monitor at 3 a.m. Dubai time, I knew the game had just entered a new phase.
The blockchain doesn’t forget. But it does take its time. The hacker who drained 2140万美元 in SOL from Step Finance back in early 2025 has finally started the wash. And the path they chose tells me more about the state of DeFi than any TVL chart ever could.
Context: The Step Finance Exploit
Step Finance is a Solana-native analytics platform — think Nansen for the Solana ecosystem. In January 2025, an attacker exploited a vulnerability in the platform’s smart contract, siphoning off roughly 2.14 million SOL (worth about $21.4M at the time). The project disclosed the incident, froze some funds, but the bulk disappeared into a wallet that went dark. No movement. No transfers. Nothing.
Until yesterday.
The market had nearly forgotten. SOL had recovered, Step Finance continued operations, and the narrative shifted to the next bull run. But the hacker was watching. Waiting. Learning.
Core: The Wash Path — A Technical Autopsy
I’ve tracked dozens of post-exploit washes. This one is textbook but carries two deliberate decisions that reveal the hacker’s profile.
First, they didn’t dump all 2.14M SOL in one go. Instead, they split the stash into multiple intermediate wallets — a classic obfuscation step. Using a Solana DEX (likely Jupiter aggregator to minimize slippage), they swapped the first batch of SOL for USDC and a small amount of ETH.
Second, they bridged those assets to Ethereum. The bridge of choice? Not the most popular one (Wormhole), but a lesser-known bridge with lower liquidity and less surveillance — proof that the hacker understands MEV dynamics and cross-chain tracking.
Once on Ethereum, they converted everything to ETH. Then came the predictable — but risky — endpoint: Tornado Cash.
I don’t need to explain what Tornado Cash is. What I want to highlight is the gas war. When the first ETH deposit hit the Tornado Cash contract, the mempool lit up. Front-running isn’t just for retail traders; MEV bots tried to sandwich the deposit transactions. The hacker countered by increasing gas to 200 gwei, spending $4,200 in transaction fees just to ensure privacy. That’s a deliberate cost — they understand the mechanics.
Contrarian: Why This Isn’t a Bear Signal for SOL
The mainstream take will be: “Hacker selling SOL, price will drop.” I disagree. Here’s why:
- The volume of SOL sold so far is approximately 500,000 SOL (about $5M). Compared to SOL’s daily spot volume of $2-3B, it’s noise.
- The 5-month delay means the market already priced in the exploit and potential sell pressure. Look on-chain: the hacker’s address was watched by dozens of tracking bots. Any sudden dump would have been anticipated.
- Furthermore, the hacker is not selling SOL aggressively — they’re washing, not market dumping. They’re using DEXs and bridges, not centralized exchanges where immediate sell orders would impact price.
Hopium? No. It’s data. The real signal is regulatory. By using Tornado Cash (a U.S.-sanctioned mixer), the hacker has made themselves a priority target for OFAC. The blockchain doesn’t lie — but the law can follow. This event will reignite the debate around privacy protocols and how DeFi can survive without them.
Takeaway: The Next Timeline
Where does the money go from here? Tornado Cash withdrawals are public. Every deposit creates a “ticket” that can be withdrawn by anyone knowing the secret. The hacker will likely withdraw to fresh Ethereum wallets, then bridge back to a privacy-focused chain (maybe Monero or Secret Network) or cash out via a compliant OTC desk.
The question isn’t if they will be caught — it’s when and which jurisdiction will make an example out of them. The $21.4M is gone from Step Finance forever. But the lesson for traders is this: never underestimate the operational sophistication of a patient hacker. The next bull run will bring more exploits, more silent wallets, and more 5-month waits. Be ready to read the chain, not the news.
