Step Finance hacker dumped 261,933 SOL in a single sale on July 5, cashing out approximately $21.4 million, and bridged it across chains into 12,128 ETH.

The funds came from a 2022 attack on Step Finance, with the address only reactivating after roughly five months of dormancy. On-chain analysis shows that the funds were ultimately deposited into Tornado Cash, a privacy coin mixing protocol on Ethereum.
In other words, security vulnerabilities from years ago are still causing a "bleed" on the chain today, and it's a combination of cross-chain activity and privacy protocols. Even though Tornado Cash has been sanctioned, hackers still use it as a money laundering tool.
From a market perspective, it's hard to draw a direct conclusion on the short-term price impact of events like this, but it's a clear reminder that the security debt of DeFi projects, cross-chain fund flows, and the regulatory tug-of-war over privacy compliance are all far from reaching their endpoint.