Audit log

Every state-changing event for Remora Markets: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-02 23:33:04Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   AZHLrxa4Hsiw…1vdYSRTdcopysha256 → base58

   verifying row…

   canonical bytes (23618 B) ▸

   {"actor":"system:backfill","investigation_id":"a587cbef-2ae8-42d1-9ea1-e6c1492fa99f","kind":"publish","page_slug":"remora-markets","published_at":"2026-08-02T23:33:03.924Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Remora Markets","sections":[{"content":"Remora Markets originated as Moose Capital, a startup focused on tokenized equity trading on Solana. In December 2024, Step Finance — a Solana DeFi portfolio aggregator self-described as the 'front page of Solana' — acquired Moose Capital as its third acquisition since 2021 and rebranded it as Remora Markets. Financial terms of the acquisition were not disclosed. Remora Markets held qualified marketplace registrations in Canada and the United Arab Emirates and initially excluded users from the United States and Europe pending regulatory approval in those jurisdictions. The platform used a mint-and-burn mechanism akin to stablecoin issuers such as Circle and Tether: verified brokers distributed redeemable rTokens on Solana representing underlying equities, with transparent proof-of-reserves and 1:1 asset backing. Initial listings included tokenized Tesla (TSLA) and Nvidia (NVDA) shares, branded as rStocks, tradeable across Raydium, Orca, and DefiTuna. Revenue from Remora Markets was structured to direct 100% of protocol revenue into Step Finance's STEP token buyback program.","heading":"Background and Corporate Structure","severity":"low","sources":[{"credibility":2,"name":"Step Finance Acquires Moose Capital, Launches Remora Markets for Tokenized Stocks — Holder.io","type":"news_article","url":"https://holder.io/news/step-finance-acquires-moose-capital-launches-remora-markets/"},{"credibility":2,"name":"Step Finance Acquires Moose Capital to Advance Equity Tokenization on Solana — Binance Square","type":"news_article","url":"https://www.binance.com/en/square/post/12-12-2024-step-finance-moose-capital-solana-17470293459921"},{"credibility":2,"name":"Remora Markets Ignites Competition in Solana RWA Market with rStocks Launch — SolanaFloor","type":"news_article","url":"https://solanafloor.com/news/solana-rwafi-boosted-by-remora-markets-launch"},{"credibility":2,"name":"Step Finance aims to bring tokenized stocks, like Nvidia and Tesla, to Solana with latest acquisition — The Block","type":"news_article","url":"https://www.theblock.co/post/330548/step-finance-tokenized-stocks-nvidia-tesla-solana"}]},{"content":"On January 31, 2026, Step Finance disclosed a critical security breach in which treasury and fee wallets were compromised. On-chain data corroborated by CertiK showed that 261,854 SOL — valued at approximately $27 million at the time of the incident — was unstaked and transferred out of Step Finance's treasury wallets. Subsequent reporting, including coverage by The Record from Recorded Future News and Tom's Hardware citing Step Finance's own statements, placed the total value of assets stolen at approximately $40 million when accounting for additional assets beyond SOL. Step Finance stated that the breach occurred through the compromise of devices belonging to members of its executive team. The company described the attack as operational rather than structural — no smart contract exploit was involved; instead, attackers obtained administrative access through compromised endpoint security on executive machines, enabling them to unstake funds and redirect assets. Step Finance said it did not initially know how wallets were accessed and engaged cybersecurity researchers and law enforcement. Approximately $3.7 million in Remora-related assets and roughly $1 million in other positions — totaling approximately $4.7 million — were subsequently recovered. The STEP governance token collapsed approximately 93–97% from pre-hack levels within 24 hours of the incident. Investor Mike Dudas, who was approached about bridge financing, publicly noted that he requested a security post-mortem before considering investment but received no response.","heading":"January 31, 2026 Step Finance Treasury Hack","severity":"critical","sources":[{"credibility":1,"name":"Crypto platform Step Finance shutting down after $40 million theft — The Record (Recorded Future News)","type":"news_article","url":"https://therecord.media/step-finance-cryptocurrency-theft-shutdown"},{"credibility":2,"name":"$40 million worth of crypto stolen from Step Finance — hackers compromise executives' devices — Tom's Hardware","type":"news_article","url":"https://www.tomshardware.com/tech-industry/cyber-security/usd40-million-worth-of-crypto-stolen-from-step-finance-hackers-compromise-executives-devices-to-gain-illicit-access"},{"credibility":1,"name":"Step Finance says compromised execs' devices led to $40M crypto theft — Bleeping Computer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/step-finance-says-compromised-execs-devices-led-to-40m-crypto-theft/"},{"credibility":2,"name":"Step Finance treasury wallets compromised — attacker unstaked 261,854 SOL (~$27.2M) — Whale Alert","type":"on_chain","url":"https://whale-alert.io/stories/f18201194ae359/Step-Finance-treasury-wallets-compromised-attacker-unstaked-261854-SOL-272M-STEP-crashes-93-to-0001578"},{"credibility":1,"name":"Step Finance shuts operations after $27 million January hack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/02/24/step-finance-shuts-operations-after-usd27-million-january-hack"},{"credibility":1,"name":"Solana DeFi platform Step Finance investigating $29 million treasury wallet compromise — The Block","type":"news_article","url":"https://www.theblock.co/post/387919/solana-defi-platform-step-finance-investigating-29-million-treasury-wallet-compromise"}]},{"content":"On February 23–24, 2026, Step Finance announced the immediate cessation of all operations, encompassing Step Finance itself, SolanaFloor, and Remora Markets. The shutdown announcement stated that the team had 'explored every possible path forward, including financing and acquisition opportunities' but had been 'unable to secure a viable outcome.' Remora Markets was explicitly noted to have been operationally isolated from the Step Finance treasury breach — the hack targeted Step Finance's own treasury and fee wallets, not Remora's underlying asset reserves. Remora announced via its official X (Twitter) account that 'all Remora rTokens remain fully backed 1:1, as they always have' and that the team was 'currently working on a redemption process to allow holders to redeem their tokens for USDC.' Step Finance indicated it had recovered approximately $3.7 million in Remora assets, which were to be directed toward the rToken redemption process. Three Solana-based platforms shutting down simultaneously drew significant attention to the concentration of operational risk within the Step Finance umbrella structure.","heading":"Shutdown of Remora Markets","severity":"high","sources":[{"credibility":2,"name":"Step Finance, SolanaFloor, and Remora Markets shut down after January hack — Web3 Is Going Great","type":"news_article","url":"https://www.web3isgoinggreat.com/single/step-finance-shuts-down"},{"credibility":1,"name":"Step Finance shuts down following $40 million security breach — The Block","type":"news_article","url":"https://www.theblock.co/post/390964/step-finance-shuts-down"},{"credibility":2,"name":"Remora Markets on X: wind-down announcement","type":"social_media","url":"https://x.com/RemoraMarkets/status/2025986960938995937"},{"credibility":2,"name":"Step Finance, SolanaFloor, and Remora Markets Shut Down After $29M Treasury Hack — Yellow.com","type":"news_article","url":"https://yellow.com/news/step-finance-solanafloor-and-remora-markets-shut-down-after-dollar29m-treasury-hack"},{"credibility":2,"name":"Three projects under the Step Finance umbrella shut down simultaneously; Remora claims rToken redeemable 1:1 — PANews","type":"news_article","url":"https://panews.io/articles/019c8d3d-c961-7660-b66c-62e7be695653"},{"credibility":2,"name":"Early Solana Platforms Shutdown After Tragic Hack Stole Millions — BeInCrypto","type":"news_article","url":"https://beincrypto.com/solana-early-pillars-step-finance-solanafloor-shut-down/"}]},{"content":"Remora Markets maintained that its rTokens were fully backed 1:1 and had been insulated from the treasury breach, and a USDC redemption mechanism was promised. However, several factors introduced material risk that users would not recover full value in a timely manner. First, Step Finance recovered only approximately $3.7 million of Remora-related assets — the precise total of outstanding rToken obligations at the time of shutdown was not publicly disclosed, creating uncertainty about sufficiency of recovered funds. Second, the shutdown was abrupt and effective immediately, leaving users without an operational platform through which to redeem. Third, on-chain liquidity in DeFi venues where rTokens traded — including Raydium and Orca — was expected to diminish rapidly following the platform closure, potentially preventing holders from exiting at par value through secondary markets. No timeline for the USDC redemption process was disclosed in the initial shutdown announcement. No independent audit of rToken backing at the time of closure has been publicly confirmed.","heading":"rToken Redemption and User Recovery Concerns","severity":"high","sources":[{"credibility":2,"name":"Remora Markets on X: wind-down announcement and rToken backing statement","type":"social_media","url":"https://x.com/RemoraMarkets/status/2025986960938995937"},{"credibility":3,"name":"Step Finance, SolanaFloor and Remora Markets cease operations after hack — UA.NEWS","type":"news_article","url":"https://ua.news/en/finansi/step-finance-solanafloor-ta-remora-markets-pripiniaiut-robotu-pislia-khakerskoyi-ataki"},{"credibility":2,"name":"Solana Hit Hard: $27 Million Exploit Triggers Wave of Shutdowns — Bitcoinist","type":"news_article","url":"https://bitcoinist.com/solana-hit-hard-27-million-exploit-triggers-wave-of-shutdowns/"},{"credibility":2,"name":"Step Finance Permanently Closes Following $27 Million Security Breach — MoneyCheck","type":"news_article","url":"https://moneycheck.com/step-finance-permanently-closes-following-27-million-security-breach/"},{"credibility":2,"name":"Three Solana Platforms to Shut Down After $27 Million Exploit — MEXC News","type":"news_article","url":"https://www.mexc.com/news/787368"}]},{"content":"The Step Finance breach revealed a structural operational risk that extended downstream to Remora Markets: the platform's treasury was controlled through devices tied to a small executive team, with no apparent multi-signature or hardware-segregated key management scheme sufficient to prevent a single-point-of-failure compromise. The attack required no smart contract exploit; control over executive devices was sufficient to drain the treasury entirely in minutes. This model of centralized operational control over an otherwise DeFi-positioned product represents an inherent counterparty risk for users of Remora Markets — even though Remora's own rToken reserves were structurally separate, the parent company's financial collapse triggered the platform's shutdown regardless. Remora Markets also operated with significant regulatory constraints: it was excluded from serving US and European users without further regulatory approval, limiting its addressable market. The revenue-sharing arrangement — directing 100% of Remora protocol revenue to the STEP buyback — created an economic coupling between the two entities that concentrated risk. No known regulatory action by the SEC, CFTC, or other financial regulators against Remora Markets specifically has been identified as of the date of this investigation.","heading":"Operational Security and Risk Factors","severity":"high","sources":[{"credibility":2,"name":"Step Finance Hack Explained: How $40M Vanished in Minutes — AssureDefi","type":"research","url":"https://www.assuredefi.io/blog/step-finance-hack-explained-40m-executive-device-breach"},{"credibility":2,"name":"Step Finance winds down after treasury breach that moved 261,854 SOL — Prism News","type":"news_article","url":"https://www.prismnews.com/news/step-finance-winds-down-after-treasury-breach-that-moved-261854-sol"},{"credibility":3,"name":"Step Finance Hack: $30M Stolen, STEP Token Plummets 90% — MojoAuth Pulse","type":"news_article","url":"https://mojoauth.com/news/step-finance-hack-30m-stolen-step-token-plummets-90"},{"credibility":2,"name":"Step Finance Expands Solana Presence with Acquisition of Moose Capital — CoinTrust","type":"news_article","url":"https://www.cointrust.com/market-news/step-finance-expands-solana-presence-with-acquisition-of-moose-capital"}]},{"content":"The Remora Markets closure was part of a documented wave of Solana-ecosystem project shutdowns in early 2026. SolanaFloor, the Solana-focused media outlet also under the Step Finance umbrella, ceased publishing simultaneously but preserved its website archive. The Step Finance hack occurred in the context of at least two other security incidents affecting crypto platforms in the same period, resulting in a combined approximately $14 million in additional losses across the sector. Remora Markets' closure was cited in reporting on over 60 crypto firms and projects shutting down during 2026, attributed to a combination of bear market conditions, hacks, and inaccessible financing. The incident is a case study in cascading counterparty risk: a treasury-level breach at the parent entity rendered an operationally separate subsidiary non-viable without any direct attack on that subsidiary's own assets.","heading":"Broader Industry Context","severity":"medium","sources":[{"credibility":2,"name":"Over 60 Crypto Firms and Projects Fold in 2026 — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/featured/over-60-crypto-firms-and-projects-fold-in-2026-as-bankruptcies-bear-market-and-hacks-rip-industry-apart/"},{"credibility":2,"name":"Three Solana Platforms to Shut Down After $27 Million Exploit — BeInCrypto","type":"news_article","url":"https://beincrypto.com/solana-early-pillars-step-finance-solanafloor-shut-down/"},{"credibility":2,"name":"Solana Hit Hard: $27 Million Exploit Triggers Wave of Shutdowns — Bitcoinist","type":"news_article","url":"https://bitcoinist.com/solana-hit-hard-27-million-exploit-triggers-wave-of-shutdowns/"},{"credibility":2,"name":"Step Finance to Wind Down After $40M Hack, STEP Token Collapses — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/step-finance-to-wind-down-after-40m-hack-step-token-collapses/"}]}],"sources_used":[{"credibility":1,"name":"Crypto platform Step Finance shutting down after $40 million theft — The Record (Recorded Future News)","type":"news_article","url":"https://therecord.media/step-finance-cryptocurrency-theft-shutdown"},{"credibility":1,"name":"Step Finance says compromised execs' devices led to $40M crypto theft — Bleeping Computer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/step-finance-says-compromised-execs-devices-led-to-40m-crypto-theft/"},{"credibility":1,"name":"Step Finance shuts operations after $27 million January hack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/02/24/step-finance-shuts-operations-after-usd27-million-january-hack"},{"credibility":1,"name":"Step Finance shuts down following $40 million security breach — The Block","type":"news_article","url":"https://www.theblock.co/post/390964/step-finance-shuts-down"},{"credibility":1,"name":"Solana DeFi platform Step Finance investigating $29 million treasury wallet compromise — The Block","type":"news_article","url":"https://www.theblock.co/post/387919/solana-defi-platform-step-finance-investigating-29-million-treasury-wallet-compromise"},{"credibility":2,"name":"$40 million worth of crypto stolen from Step Finance — Tom's Hardware","type":"news_article","url":"https://www.tomshardware.com/tech-industry/cyber-security/usd40-million-worth-of-crypto-stolen-from-step-finance-hackers-compromise-executives-devices-to-gain-illicit-access"},{"credibility":2,"name":"Step Finance, SolanaFloor, and Remora Markets shut down after January hack — Web3 Is Going Great","type":"news_article","url":"https://www.web3isgoinggreat.com/single/step-finance-shuts-down"},{"credibility":1,"name":"Step Finance aims to bring tokenized stocks to Solana with latest acquisition — The Block","type":"news_article","url":"https://www.theblock.co/post/330548/step-finance-tokenized-stocks-nvidia-tesla-solana"},{"credibility":2,"name":"Step Finance Acquires Moose Capital, Launches Remora Markets for Tokenized Stocks — Holder.io","type":"news_article","url":"https://holder.io/news/step-finance-acquires-moose-capital-launches-remora-markets/"},{"credibility":2,"name":"Step Finance Acquires Moose Capital to Advance Equity Tokenization on Solana — Binance Square","type":"news_article","url":"https://www.binance.com/en/square/post/12-12-2024-step-finance-moose-capital-solana-17470293459921"},{"credibility":2,"name":"Remora Markets Ignites Competition in Solana RWA Market with rStocks Launch — SolanaFloor","type":"news_article","url":"https://solanafloor.com/news/solana-rwafi-boosted-by-remora-markets-launch"},{"credibility":2,"name":"Step Finance, SolanaFloor, and Remora Markets Shut Down After $29M Treasury Hack — Yellow.com","type":"news_article","url":"https://yellow.com/news/step-finance-solanafloor-and-remora-markets-shut-down-after-dollar29m-treasury-hack"},{"credibility":2,"name":"Three projects under the Step Finance umbrella shut down; Remora claims rToken redeemable 1:1 — PANews","type":"news_article","url":"https://panews.io/articles/019c8d3d-c961-7660-b66c-62e7be695653"},{"credibility":2,"name":"Remora Markets on X: wind-down announcement and rToken backing statement","type":"social_media","url":"https://x.com/RemoraMarkets/status/2025986960938995937"},{"credibility":2,"name":"Step Finance treasury wallets compromised — attacker unstaked 261,854 SOL — Whale Alert","type":"on_chain","url":"https://whale-alert.io/stories/f18201194ae359/Step-Finance-treasury-wallets-compromised-attacker-unstaked-261854-SOL-272M-STEP-crashes-93-to-0001578"},{"credibility":2,"name":"Step Finance Hack Explained: How $40M Vanished in Minutes — AssureDefi","type":"research","url":"https://www.assuredefi.io/blog/step-finance-hack-explained-40m-executive-device-breach"},{"credibility":2,"name":"Solana Hit Hard: $27 Million Exploit Triggers Wave of Shutdowns — Bitcoinist","type":"news_article","url":"https://bitcoinist.com/solana-hit-hard-27-million-exploit-triggers-wave-of-shutdowns/"},{"credibility":2,"name":"Early Solana Platforms Shutdown After Tragic Hack Stole Millions — BeInCrypto","type":"news_article","url":"https://beincrypto.com/solana-early-pillars-step-finance-solanafloor-shut-down/"},{"credibility":2,"name":"Step Finance to Wind Down After $40M Hack, STEP Token Collapses — FinanceFeeds","type":"news_article","url":"https://financefeeds.com/step-finance-to-wind-down-after-40m-hack-step-token-collapses/"},{"credibility":2,"name":"Three Solana Platforms to Shut Down After $27 Million Exploit — MEXC News","type":"news_article","url":"https://www.mexc.com/news/787368"},{"credibility":2,"name":"Over 60 Crypto Firms and Projects Fold in 2026 — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/featured/over-60-crypto-firms-and-projects-fold-in-2026-as-bankruptcies-bear-market-and-hacks-rip-industry-apart/"},{"credibility":2,"name":"Step Finance winds down after treasury breach that moved 261,854 SOL — Prism News","type":"news_article","url":"https://www.prismnews.com/news/step-finance-winds-down-after-treasury-breach-that-moved-261854-sol"},{"credibility":3,"name":"Tokenized Stocks: New Opportunities for Institutional Investors with Remora — Dapp.Expert","type":"news_article","url":"https://dapp.expert/news/en_tokenized-stocks-new-opportunities-for-institutional-investors-with-remora-1742985247-872169"},{"credibility":2,"name":"Step Finance Expands Solana Presence with Acquisition of Moose Capital — CoinTrust","type":"news_article","url":"https://www.cointrust.com/market-news/step-finance-expands-solana-presence-with-acquisition-of-moose-capital"}],"summary":"Remora Markets was a Solana-based tokenized real-world asset (RWA) platform acquired by Step Finance in December 2024, originally operating as Moose Capital, that offered tokenized equities such as Tesla and Nvidia shares via on-chain rTokens. On February 24, 2026, Step Finance announced the immediate wind-down of all operations — including Remora Markets and media affiliate SolanaFloor — after a January 31, 2026 hack drained approximately $27–40 million from Step Finance treasury wallets through compromised executive devices, leaving the parent entity unable to secure financing or an acquisition. Remora stated that rTokens remained fully backed 1:1 and that a USDC redemption process was being developed, though the abrupt shutdown and constrained recovery funds raised significant concerns about users' ability to recover full value in a timely manner.","timeline":[{"date":"2024-12-12","event":"Step Finance announced the acquisition of Moose Capital, rebranding it as Remora Markets, to expand into tokenized equity trading on Solana. Financial terms undisclosed. Launch targeted for Q1 2025.","source":"Holder.io / Binance Square","source_url":"https://holder.io/news/step-finance-acquires-moose-capital-launches-remora-markets/"},{"date":"2025-01-01","event":"Remora Markets launched rStocks on Solana, offering tokenized Tesla and Nvidia shares. Platform reported cumulative revenue crossing $110 million. Solana RWA sector market cap grew 187% year-over-year to $499 million.","source":"SolanaFloor","source_url":"https://solanafloor.com/news/solana-rwafi-boosted-by-remora-markets-launch"},{"date":"2026-01-31","event":"Step Finance treasury wallets compromised. Attackers, through alleged compromise of executive team devices, unstaked and transferred 261,854 SOL (approximately $27–40 million at the time). STEP token collapsed approximately 93% within 24 hours. Law enforcement notified and cybersecurity firms engaged.","source":"The Record / CoinDesk / Bleeping Computer","source_url":"https://therecord.media/step-finance-cryptocurrency-theft-shutdown"},{"date":"2026-02-01","event":"Step Finance began investigation with cybersecurity researchers. Approximately $4.7 million recovered ($3.7M in Remora assets, $1M in other positions). Financing and acquisition discussions initiated.","source":"The Record (Recorded Future News)","source_url":"https://therecord.media/step-finance-cryptocurrency-theft-shutdown"},{"date":"2026-02-23","event":"Step Finance announced it was 'unable to secure a viable outcome' after exploring financing and acquisition options. Immediate wind-down of all operations announced, including Remora Markets and SolanaFloor.","source":"CoinDesk / The Block","source_url":"https://www.coindesk.com/business/2026/02/24/step-finance-shuts-operations-after-usd27-million-january-hack"},{"date":"2026-02-24","event":"Remora Markets officially ceased operations. Remora announced via X that all rTokens remained fully backed 1:1 and that a USDC redemption process was being developed. No timeline was provided for redemption. SolanaFloor ceased publishing but preserved its archive.","source":"PANews / Remora Markets on X","source_url":"https://x.com/RemoraMarkets/status/2025986960938995937"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ff08ec99-001c-4440-ace3-4707c324340fcopy