The wallet linked to the Step Finance exploit has resurfaced after five months of inactivity, selling 261,933 SOL worth approximately $21.4 million and bridging the proceeds to Ethereum.
Step Finance exploiter moves dormant funds after five months
Blockchain security firm PeckShield flagged the wallet activity, drawing attention to the exploiter’s first significant on-chain movement in roughly five months. The wallet had remained entirely dormant during that period, with no outbound transfers recorded. For related coverage, see BTSE Launches Crypto Platform in Indonesia, Expands Local Market Push.
The reactivation is notable because exploit-linked wallets that stay quiet for extended periods often attract less monitoring over time. When they suddenly move large sums, the activity tends to catch both security researchers and market participants off guard. For related coverage, see Kraken Adds Tokenized Apple, Nvidia, and Tesla Shares as Collateral.
ON-CHAIN DATA
- Exploiter wallet: LEP1uHX…o6SdNu
- Amount sold: 261,933 SOL (~$21.4M)
- Destination chain: Ethereum
- Dormancy period: ~5 months
261,933 SOL sold before the Ethereum bridge
The exploiter first liquidated 261,933 SOL valued at $21.4 million. The sale converted the Solana-native tokens into stablecoins or other liquid assets before the cross-chain transfer took place. For related coverage, see Kraken Allows Tokenized Stocks as Collateral for Leveraged Trades.
After completing the sale, the exploiter bridged the resulting funds to Ethereum. The two-step sequence, selling SOL first and then moving the proceeds to a different chain, is a common pattern observed in exploit-related fund movements tracked on platforms like DeFiLlama’s hack tracker. For related coverage, see Zcash Ironwood Upgrade Finalized Before July 21 Launch.
Why the cross-chain move draws scrutiny
Bridging exploit proceeds from Solana to Ethereum complicates on-chain tracking because investigators must follow the trail across two separate blockchain networks. Ethereum’s deeper liquidity and larger number of mixing and swapping options make it a frequent destination for funds that exploiters want to obscure.
The move comes at a time when DeFi security remains a persistent concern across the industry. Protocols on multiple chains, including those that have recently seen deposit growth such as Aave’s expanding markets on new chains, continue to face scrutiny over how well they protect user funds.
Security researchers and on-chain analysts are monitoring the Ethereum-side addresses for further movement. Whether the funds are routed through mixers, swapped into other tokens, or left dormant again remains an open question that blockchain forensics teams are actively tracking.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
