Step Finance Treasury Theft (January 2026)
Summary
On January 31, 2026, Step Finance, a Solana-based portfolio tracking and DeFi analytics platform, suffered a treasury theft in which an attacker drained approximately 261,854 SOL (valued at roughly $27.3 million at the time) after compromising executive team devices and seizing staking authority over protocol wallets. The incident led to a 93% collapse in the STEP governance token price and ultimately forced the permanent shutdown of Step Finance and its affiliated projects SolanaFloor and Remora Markets by February 24, 2026.
Connected Entities
3 entities · 10 linked investigations- LEP1uHXcWbFEPwQgkeFzdhW2ykgZY6e9Dz8Yro6SdNu→mentioned with→Step Finance Treasury Theft (January 2026)(50%)
- 7raxiejD8hDUH1wyYWFDPrEuHiLUjJ4RiZi2z1u2udNh→mentioned with→Step Finance Treasury Theft (January 2026)(50%)
Timeline(7 events)
2021-02-01
Step Finance founded, originating from a Solana hackathon; initially a DCA contract before pivoting to a portfolio tracker.
Solana Compass2026-01-31
Attacker compromises executive team devices, seizes staker and withdrawer authority over Step Finance's staked SOL positions, unstakes and drains approximately 261,854 SOL (~$27.3M) from treasury wallets during APAC trading hours.
CoinDesk2026-01-31
Step Finance discloses breach publicly on X (formerly Twitter), describes it as a compromise of 'several treasury wallets' by 'a sophisticated actor.' STEP token crashes approximately 93% within 24 hours.
CoinTelegraph via TradingView2026-01-31
CertiK confirms on-chain that 261,854 SOL was unstaked and transferred from Step Finance-controlled wallets to attacker-controlled addresses.
Rekt News2026-02-02
Step Finance confirms that the breach originated from the compromise of executive team members' devices.
Rekt News / Halborn Security2026-02-24
Step Finance announces permanent shutdown of all operations, citing inability to secure financing or acquisition after exhausting all strategic alternatives. SolanaFloor and Remora Markets also cease operations. STEP token falls an additional 34-36% on the announcement.
CoinDesk2026-02-24
Co-founder George Harrap states the shutdown is 'a difficult day' and prioritizes finding roles for team members. Step Finance announces a STEP token buyback program based on a pre-hack snapshot, and a separate Remora token redemption process. Approximately $4.7M in assets recovered through Token22 and Remora holdings.
The Record (Recorded Future News)Decision Log
- hash: 6FzZQUpv8pSX4dsmES9qmKgcsvy5nTKYM7wYXnv4GwaL
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/14/2026, 2:43:03 PM
last updated: 6/14/2026, 2:43:13 PM
avoid.net — verified advice for a post-truth world