QooryBeta
Back to narratives
SecurityActive
Conversation intelligence

Step Finance and UXLINK Exploiters Launder $38M Through Tornado Cash

After months of dormancy, attackers from the Step Finance and UXLINK hacks moved approximately $38 million in stolen crypto through Tornado Cash in a single afternoon, laundering the funds to obscure their trail.

Heat
101
Confidence
95%
Evidence
7
Updated

Why It Happened

The Step Finance attacker sold 261,933 SOL ($21.4M) after 5 months, bridged to Ethereum, bought 12,128 ETH, and deposited into Tornado Cash. The UXLINK attacker also deposited 6,038 ETH into Tornado Cash, with total deposits exceeding $21M from two separate incidents.

Outcome So Far

Funds have been laundered through Tornado Cash; further monitoring ongoing.

Actors

STStep Finance exploiterattacker
UXUXLINK exploiterattacker
Timeline order

Post
Parent event 01

UXLINK Exploiter Also Moves Funds to Tornado Cash

The UXLINK exploiter swapped ~10.54M DAI for 6,000.8 ETH and deposited 6,038 ETH into Tornado Cash, totaling 14,336.6 ETH deposited over two weeks.

Related posts@PeckShieldAlert@SpecterAnalyst
@PeckShieldAlert
Open on X18.5K views · 61 likes · 8 reposts
@SpecterAnalyst
Open on X11.2K views · 45 likes · 6 reposts

Post
Parent event 02

X conversation update

1 related posts from @Jeremybtc

Related posts@Jeremybtc
@Jeremybtc
Open on X24.4K views · 235 likes · 22 reposts

Post
Parent event 03

X conversation update

3 related posts from @lookonchain, @solananew, @WhalePiz

Related posts@lookonchain@solananew@WhalePiz
@lookonchain
Open on X83.6K views · 283 likes · 19 reposts
@solananew
Open on X7.9K views · 91 likes · 8 reposts
@WhalePiz
Open on X1.9K views · 27 likes · 1 reposts

Post
Parent event 04

Step Finance Attacker Completes Full Laundering

The Step Finance attacker sold all 261,933 SOL ($21.4M), bought 12,128 ETH, and deposited all ETH into Tornado Cash in a single transaction series.

Related posts@huoshan007
@huoshan007
Open on X8.5K views · 6 likes · 0 reposts