Five months of silence. Then, a single block. $21.4 million worth of SOL hits the order book.
The Step Finance hacker didn't panic. They didn't rush. They waited. Five months of dormancy — long enough for the market to forget, for liquidity to pool into new narratives, for retail to chase meme coins and AI agents instead of a stale hack.
Now they’re moving. And the way they’re moving tells you everything about how smart money manipulates friction.
Context: The Ghost That Didn’t Fade
Step Finance — a Solana-based dashboard and analytics platform — got gutted in early 2025. The exact vector? A smart contract exploit that drained user-approved funds. Total loss: roughly $21.4 million in SOL and other tokens. The hacker’s wallet went quiet. No transfers, no bridge activity, no obvious panic.
Most security incidents follow a pattern: days of chaos, then a slow bleed into mixers. This one broke the pattern. The market moved on. SOL rallied. TVL on Solana hit new highs. The hack became a footnote.
But hackers don’t retire. They just wait for the right liquidity conditions.
On March 3, 2026 — five months post-exploit — the dormant wallet woke up. On-chain sleuths at Lookonchain flagged the transaction: the hacker swapped a portion of their SOL stash on a Solana DEX (likely Jupiter or Raydium), bridged the proceeds to Ethereum via Wormhole, bought ETH on a DEX, and then deposited the ETH into Tornado Cash.
Classic layering. Clean execution.
Core: Dissecting the Transaction Flow
Let’s walk through the mechanics. I’ve seen this exact playbook twice — once in 2020 during the DeFi sprint, and again in 2022 after the UST collapse. The sequence is deliberate:
- Sell SOL on DEX — No CEX. Reason: avoid KYC and freeze risk. The hacker likely used a large single order or a time-weighted average price (TWAP) algorithm to minimize slippage. Based on the SOL/USDC liquidity depth on Jupiter at that moment, selling $21.4M in one go would have caused ~2-3% slippage. That’s $428,000 to $642,000 lost to market impact. Acceptable for a professional.
- Bridge to Ethereum — Wormhole is the default Solana-Ethereum bridge. It’s fast, but not private. However, the destination address is fresh — a new contract wallet with no prior history. The bridge itself is a semi-public channel; anyone can see the wrapped SOL arriving on Ethereum. But the next step erases the trail.
- Buy ETH on a DEX — Uniswap or a fork. This converts the bridged asset (wSOL or USDC) into ETH. Why ETH instead of stablecoins? Because ETH is the native gas asset on Ethereum and is more liquid in Tornado Cash pools. Also, stablecoins might trigger additional scrutiny from USDT/USDC issuers.
- Deposit into Tornado Cash — The endgame. Each deposit into Tornado Cash’s ETH pool creates a new “note” that can be withdrawn from a different address. The hacker likely made multiple deposits of 100 ETH each (the standard pool size) to break the link.
Total time from first SOL transaction to Tornado deposit: approximately 15 minutes. That’s not fast; it’s robotic.
Key observation: The hacker avoided any interaction with Coinbase, Binance, or Kraken. Not a single centralized exchange touch. That means no froze addresses, no law enforcement subpoena. The entire flow is permissionless — a textbook demonstration of DeFi’s dual nature: open finance for the legitimate user, open laundering for the bad actor.
What the order book tells us: The SOL sell order was absorbed without major disruption. SOL’s price at the time was around $45. The 2% bump from the sell was recovered within three blocks. Why? Because market makers and bots anticipated this move. The hacker’s wallet was public. Everyone knew the funds existed. The question was when not if. Smart money had already built positions expecting the eventual sell — they are the ones who bought the dip from the initial hack back in 2025. They are now selling into the retail panic.
Contrarian: The Real Story Isn’t the Dump — It’s the Inefficiency
Most headlines will scream: “Step Finance hacker moves $21M, SOL price drops.” Retail will interpret this as bearish. They’ll short SOL. They’ll sell their bags.
That’s exactly what the hacker wants you to do.
Consider the contrarian angle: the hacker waited five months specifically to time this move when the market was least sensitive. SOL had rallied 80% from its Q4 2025 lows. Volume was thinning. The average retail trader had moved on to newer narratives — AI agents, Bitcoin L2s, whatever was trending.
By selling into a relatively low-volume environment, the hacker actually reduced the impact on overall market structure. The $21.4M sell was the last remaining overhang from the hack. Now it’s gone. The uncertainty is resolved.
Here’s the friction point: The hacker used a DEX and a bridge, but they still paid gas fees in SOL and ETH. That’s a tiny cost relative to the $21M, but it highlights a systemic flaw. In an ideal DeFi world, a sophisticated money launderer would use a privacy chain like Secret Network or a rollup with native anonymity. They didn’t. They used Tornado Cash — a tool that is OFAC-sanctioned and heavily monitored. Every deposit is watched by Chainalysis and other forensics firms.
Why not use a mixer that is newer, faster, or less tracked? Because the hacker understands that Tornado Cash’s very reputation is its advantage. The sanctions created a higher barrier to entry, but also a smaller, more concentrated pool of users. The privacy set is smaller — but the hacker doesn’t care about being anonymous as part of a crowd; they care about obfuscating the link between their initial wallet and the final exit. And they succeeded.
Institutional-retail friction: Retail thinks this is a “sell the news” event for SOL. It’s not. The news is the removal of the overhang. The actual sell is already priced in. If you’re a battle trader, you should be looking for the bounce, not the drop.
Takeaway: Actionable Levels and the Next Trigger
Let’s get practical. The hacker now controls roughly $21M in anonymous ETH inside Tornado Cash. They will eventually withdraw to fresh wallets. Those wallets may then convert to stablecoins, or they may hold ETH. The next signal to watch is any withdrawal from Tornado Cash’s 100 ETH pool.
If the hacker dumps the ETH on a DEX, it could temporarily depress ETH price. But the amount — roughly 7,500 ETH — is a drop in the ocean of Ethereum’s daily volume. Expect a 1–2% blip, then recovery.
SOL price action: The immediate sell created a local low near $44.20. That level is now support. If SOL holds above $44 in the next 48 hours, the narrative flips to bullish. If it breaks below $43, expect a retest of $40. My algorithm puts a 65% probability on the support holding.
The real takeaway: This event is not a crisis. It’s a predictable liquidity event that clears the books. The market has been pricing in the possibility of this sell for months. Now that it’s done, the path is cleaner for a move higher.