The person (or persons) who drained Step Finance of roughly 261,854 SOL tokens has moved to the next phase of every crypto heist playbook: the laundering stage. The exploiter sold a significant chunk of stolen SOL, bridged $21.4 million to Ethereum, purchased ETH, and funneled the proceeds through Tornado Cash.
What happened at Step Finance
Step Finance, a DeFi portfolio management platform built on Solana, was hit on January 31 when attackers gained unauthorized access to treasury and fee wallets. The haul came to approximately 261,854 SOL, worth somewhere between $27 million and $30 million at the time of the breach.
The attack vector was compromised executive team devices, likely through phishing or social engineering. The smart contracts worked fine. The people managing them did not.
Total losses ballooned to around $40 million when accounting for the full impact, with only about $4.7 million recovered through partnerships and features like Token22. That recovery rate, roughly 12% of total losses, is not exactly a victory lap.
