Step Finance hack — January 2026

Step Finance, a Solana-based DeFi dashboard and swap aggregator that also operated SolanaFloor and the Remora Markets exchange, disclosed on 31 January 2026 that several of its treasury and fee wallets had been drained. The team said the loss did not stem from a flaw in its smart contracts. The attacker gained control of the wallets after devices belonging to members of the executive team were compromised, which the company described only as "a well known attack vector" and said occurred during APAC hours. No specific malware, phishing lure or intrusion path has been published, and no source establishes that private keys themselves were extracted.

The reported size of the loss varies by more than the difference between two estimates. CertiK's on-chain review found that 261,854 SOL was unstaked and transferred to an address outside Step's control; CoinDesk valued that at roughly $27 million on the day of disclosure, while BleepingComputer valued the same quantity at about $28.9 million. Halborn's later write-up put the loss at approximately $30 million. Step Finance itself said its own investigation determined the total taken across the affected wallets was approximately $40 million. The company figure has never been reconciled publicly with the on-chain analyses.

Working with partners and using Solana Token22 freeze controls, the team recovered about $4.7 million, which it broke down as $3.7 million in Remora assets and $1 million in other positions. The STEP token lost the large majority of its value. On 24 February 2026 Step Finance announced it was winding down Step Finance, SolanaFloor and Remora Markets effective immediately, saying it had explored financing and acquisition options without securing a viable outcome, and that it would attempt a buyback for STEP holders based on a snapshot of holdings taken before the incident. No attacker has been identified.