Back
Step Finance attacker moves 12,128 ETH into Tornado Cash after selling SOL

Step Finance attacker moves 12,128 ETH into Tornado Cash after selling SOL

Lookonchain linked six addresses to the Step Finance attacker, saying they sold 261,933 SOL worth $21.4 million, bridged the proceeds from Solana to Ethereum via Circle CCTP, bought ETH on CowSwap, and sent it to Tornado Cash.

ETH
SOL
USDC

Fact Check
The original Lookonchain X post confirms every key figure in the claim: 261,933 SOL sold worth $21.4M, bridged from Solana to Ethereum, 12,128 ETH bought, and deposited into Tornado Cash. Multiple secondary outlets (odaily, cryptorank/CoinCu) independently report the same numbers. The only specific claim detail not explicitly named in the Lookonchain summary is the use of Circle CCTP for bridging and CowSwap for the ETH purchase, but these mechanism details are consistent with the caller's aggregated reporting and do not contradict the on-chain narrative.
    Reference: 123
Summary

A wallet identified by Lookonchain as the Step Finance attacker became active after five months and sold 261,933 SOL valued at $21.4 million. According to Lookonchain and on-chain analyst Ai Yi, the proceeds were bridged from Solana to Ethereum using USDC via Circle CCTP, then six addresses bought 12,128 ETH on CowSwap over roughly two hours at an average price of $1,760.55 before transferring the ETH in batches to Tornado Cash. Ai Yi added that the source address history can be traced back about four years. The cross-chain movement into a mixer is likely to draw scrutiny from blockchain investigators because Tornado Cash is designed to obscure transaction trails.

Terms & Concepts
  • Tornado Cash: A crypto mixer designed to obscure transaction trails.
  • Circle CCTP: Circle's cross-chain transfer protocol for moving supported tokens between blockchains.
  • CowSwap: A decentralized trading protocol used for token swaps.