Step Finance — AI Agent Over-Permission Exploit (January 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5cRM8F…Zw4oSummary
Step Finance, a Solana DeFi portfolio manager and aggregator founded in 2021, suffered a treasury breach on January 31, 2026, in which attackers compromised executive devices and exploited AI trading agents with unconstrained transfer authority to drain an estimated $27–40 million in SOL. Unable to secure refinancing or an acquisition, the project permanently shut down on February 24, 2026, along with affiliated platforms SolanaFloor and Remora Markets, with only $4.7 million recovered.
Connected Entities
3 entities · 2 linked investigations- 7raxie…udNh→mentioned with→Step Finance — AI Agent Over-Permission Exploit (January 2026)(50%)
- LEP1uH…SdNu→mentioned with→Step Finance — AI Agent Over-Permission Exploit (January 2026)(50%)
Connected Through
2 shared actors · 2 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ◇7raxie…udNhwallet
- ◇LEP1uH…SdNuwallet
Timeline(8 events)
2021
Step Finance launched on Solana as a DeFi portfolio aggregator and yield management platform, later described as the 'front page of Solana.'
CoinDesk31 January 2026
Attackers compromised executive devices, transferred stake authorization to an attacker-controlled wallet, and drained 261,854 SOL (approximately $27–30 million) from treasury wallets within roughly 90 minutes. Step Finance disclosed the breach the same day.
CoinDesk / Rekt News2 February 2026
Step Finance confirmed that the root cause was the compromise of executive team devices, consistent with a phishing or social engineering attack. Total claimed losses revised to approximately $40 million.
Rekt News / Tom's Hardware5 February 2026
Approximately $4.7 million recovered through Token22 security protections and partner coordination, primarily from Remora Markets-related assets.
CoinDesk23 February 2026
Step Finance co-founder George Harrap announced via X (Twitter) that the project was immediately shutting down all operations after failing to secure financing or an acquisition. SolanaFloor and Remora Markets also announced closure.
CoinTelegraph / Decrypt24 February 2026
Shutdown formalized. STEP token fell an additional 36% on the announcement day, reaching $0.00057. Buyback program for STEP holders and rToken redemption process announced.
CoinDeskMarch 2026
Post-incident on-chain tracking by Arkham Intelligence revealed the exploiter sold stolen SOL and bridged approximately $21.4 million to Ethereum before routing funds through Tornado Cash.
Crypto BriefingDecision Log
- hash: 2qSjusnpn7tgDzxT2wZUdr1DTnZmfStGXY4APsNmKvGo
- hash: DM9ZPD8P5wTpJgPTCi6DAyyaBRiaUb3phwotsYYgd7tT
- hash: 6eHmwquz3yVZzm7WMDwjXiRgh8BKHzPdyVRnj38Jacs6
This investigation is cryptographically anchored to the Solana blockchain (3 events). 14 of 14 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/3/2026, 5:12:29 PM
last updated: 8/27/2026, 3:14:12 AM
5 viewsavoid.net — verified advice for a post-truth world