Ethereum

Step Finance

Tesla

Zcash

Read

<p><strong>The wallet linked to the Step Finance exploit has resurfaced after five months of inactivity, selling 261,933 SOL worth approximately $21.4 million and bridging the proceeds to Ethereum.</strong></p>
<h2 id="step-finance-exploiter-moves-dormant-funds-after-five-months">Step Finance exploiter moves dormant funds after five months</h2>
<p>Blockchain security firm PeckShield <a href="https://x.com/peckshield?lang=en" rel="noopener noreferrer nofollow">flagged the wallet activity</a>, drawing attention to the exploiter's first significant on-chain movement in roughly five months. The wallet had remained entirely dormant during that period, with no outbound transfers recorded. For related coverage, see <a href="https://www.kanalcoin.com/btse-launches-crypto-platform-in-indonesia/" rel="noopener noreferrer nofollow">BTSE Launches Crypto Platform in Indonesia, Expands Local Market Push</a>.</p>
<p>The reactivation is notable because exploit-linked wallets that stay quiet for extended periods often attract less monitoring over time. When they suddenly move large sums, the activity tends to catch both security researchers and market participants off guard. For related coverage, see <a href="https://www.kanalcoin.com/kraken-adds-tokenized-apple-nvidia-tesla-shares-as-collateral/" rel="noopener noreferrer nofollow">Kraken Adds Tokenized Apple, Nvidia, and Tesla Shares as Collateral</a>.</p>
<div class="on-chain-data">
 <p>ON-CHAIN DATA</p>
 <ul>
  <li><strong>Exploiter wallet:</strong><a href="https://solscan.io/account/LEP1uHXcWbFEPwQgkeFzdhW2ykgZY6e9Dz8Yro6SdNu" rel="noopener noreferrer nofollow">LEP1uHX...o6SdNu</a></li>
  <li><strong>Amount sold:</strong> 261,933 SOL (~$21.4M)</li>
  <li><strong>Destination chain:</strong> Ethereum</li>
  <li><strong>Dormancy period:</strong> ~5 months</li>
 </ul>
</div>
<h2 id="261-933-sol-sold-before-the-ethereum-bridge">261,933 SOL sold before the Ethereum bridge</h2>
<p>The exploiter first liquidated <a href="https://solscan.io/account/7raxiejD8hDUH1wyYWFDPrEuHiLUjJ4RiZi2z1u2udNh" rel="noopener noreferrer nofollow">261,933 SOL</a> valued at $21.4 million. The sale converted the Solana-native tokens into stablecoins or other liquid assets before the cross-chain transfer took place. For related coverage, see <a href="https://www.kanalcoin.com/kraken-tokenized-stocks-collateral-leveraged-trades/" rel="noopener noreferrer nofollow">Kraken Allows Tokenized Stocks as Collateral for Leveraged Trades</a>.</p>
<p>After completing the sale, the exploiter bridged the resulting funds to Ethereum. The two-step sequence, selling SOL first and then moving the proceeds to a different chain, is a common pattern observed in exploit-related fund movements tracked on platforms like <a href="https://defillama.com/hacks" rel="noopener noreferrer nofollow">DeFiLlama's hack tracker</a>. For related coverage, see <a href="https://www.kanalcoin.com/zcash-ironwood-upgrade-finalized-july-21-mainnet-launch/" rel="noopener noreferrer nofollow">Zcash Ironwood Upgrade Finalized Before July 21 Launch</a>.</p>
<h2 id="why-the-cross-chain-move-draws-scrutiny">Why the cross-chain move draws scrutiny</h2>
<p>Bridging exploit proceeds from Solana to Ethereum complicates on-chain tracking because investigators must follow the trail across two separate blockchain networks. Ethereum's deeper liquidity and larger number of mixing and swapping options make it a frequent destination for funds that exploiters want to obscure.</p>
<p>The move comes at a time when DeFi security remains a persistent concern across the industry. Protocols on multiple chains, including those that have recently seen deposit growth such as <a href="https://www.kanalcoin.com/aave-monad-market-tops-100-million-deposits-after-v3-launch/" rel="noopener noreferrer nofollow">Aave's expanding markets on new chains</a>, continue to face scrutiny over how well they protect user funds.</p>
<p>Security researchers and on-chain analysts are monitoring the Ethereum-side addresses for further movement. Whether the funds are routed through mixers, swapped into other tokens, or left dormant again remains an open question that blockchain forensics teams are actively tracking.</p>
<p>Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p><a href="https://www.kanalcoin.com/?p=66237" rel="noopener noreferrer nofollow">Read original article on kanalcoin.com</a>

Step Finance exploiter sells 261,933 SOL worth $21.4M, bridges funds to Ethereum

Table of Contents

Kanalcoin

Other articles published on Jul 5, 2026

Join our free newsletter for daily crypto updates!