Step Finance — AI Agent Over-Permission Exploit (January 2026)
Summary
Step Finance, a Solana DeFi portfolio manager and aggregator founded in 2021, suffered a treasury breach on January 31, 2026, in which attackers compromised executive devices and exploited AI trading agents with unconstrained transfer authority to drain an estimated $27–40 million in SOL. Unable to secure refinancing or an acquisition, the project permanently shut down on February 24, 2026, along with affiliated platforms SolanaFloor and Remora Markets, with only $4.7 million recovered.
Connected Entities
3 entities · 10 linked investigations- 7raxiejD8hDUH1wyYWFDPrEuHiLUjJ4RiZi2z1u2udNh→mentioned with→Step Finance — AI Agent Over-Permission Exploit (January 2026)(50%)
- LEP1uHXcWbFEPwQgkeFzdhW2ykgZY6e9Dz8Yro6SdNu→mentioned with→Step Finance — AI Agent Over-Permission Exploit (January 2026)(50%)
Connected Through
2 shared actors · 2 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ◇7raxie…udNhwallet
- ◇LEP1uH…SdNuwallet
Timeline(8 events)
2021-01-01
Step Finance launched on Solana as a DeFi portfolio aggregator and yield management platform, later described as the 'front page of Solana.'
CoinDesk2026-01-31
Attackers compromised executive devices, transferred stake authorization to an attacker-controlled wallet, and drained 261,854 SOL (approximately $27–30 million) from treasury wallets within roughly 90 minutes. Step Finance disclosed the breach the same day.
CoinDesk / Rekt News2026-02-02
Step Finance confirmed that the root cause was the compromise of executive team devices, consistent with a phishing or social engineering attack. Total claimed losses revised to approximately $40 million.
Rekt News / Tom's Hardware2026-02-05
Approximately $4.7 million recovered through Token22 security protections and partner coordination, primarily from Remora Markets-related assets.
CoinDesk2026-02-23
Step Finance co-founder George Harrap announced via X (Twitter) that the project was immediately shutting down all operations after failing to secure financing or an acquisition. SolanaFloor and Remora Markets also announced closure.
CoinTelegraph / Decrypt2026-02-24
Shutdown formalized. STEP token fell an additional 36% on the announcement day, reaching $0.00057. Buyback program for STEP holders and rToken redemption process announced.
CoinDesk2026-03-01
Post-incident on-chain tracking by Arkham Intelligence revealed the exploiter sold stolen SOL and bridged approximately $21.4 million to Ethereum before routing funds through Tornado Cash.
Crypto BriefingDecision Log
- #1publish⛓ pending8/3/2026, 5:12:40 PMhash: 6eHmwquz3yVZzm7WMDwjXiRgh8BKHzPdyVRnj38Jacs6
13 of 14 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/3/2026, 5:12:29 PM
last updated: 8/3/2026, 8:24:31 PM
avoid.net — verified advice for a post-truth world