Step Finance Treasury Theft (January 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·57rWSz…MeLrSummary
On January 31, 2026, Step Finance, a Solana-based portfolio tracking and DeFi analytics platform, suffered a treasury theft in which an attacker drained approximately 261,854 SOL (valued at roughly $27.3 million at the time) after compromising executive team devices and seizing staking authority over protocol wallets. The incident led to a 93% collapse in the STEP governance token price and ultimately forced the permanent shutdown of Step Finance and its affiliated projects SolanaFloor and Remora Markets by February 24, 2026.
Connected Entities
8 entities · 60 linked investigations- LEP1uH…SdNu→mentioned with→Step Finance Treasury Theft (January 2026)(50%)
- 7raxie…udNh→mentioned with→Step Finance Treasury Theft (January 2026)(50%)
- Remora Markets→mentioned with→Solana(80%)
- Step Finance Treasury Theft (January 2026)→mentioned with→Remora Markets(80%)
- Step Finance Treasury Theft (January 2026)→mentioned with→Drift Protocol(80%)
- Step Finance Treasury Theft (January 2026)→mentioned with→Rhea Finance(80%)
- Solana→mentioned with→Drift Protocol(80%)
- Drift→mentioned with→Solana(80%)
- Step Finance Treasury Theft (January 2026)→mentioned with→Solana(80%)
- Solana→mentioned with→Drift(80%)
- + 2 more
Connected Through
7 shared actors · 379 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Solanaorganization
- ⌂Drift Protocolprotocol
- □Driftorganization
- ⌂Rhea Financeprotocol
Timeline(7 events)
February 2021
Step Finance founded, originating from a Solana hackathon; initially a DCA contract before pivoting to a portfolio tracker.
Solana Compass31 January 2026
Attacker compromises executive team devices, seizes staker and withdrawer authority over Step Finance's staked SOL positions, unstakes and drains approximately 261,854 SOL (~$27.3M) from treasury wallets during APAC trading hours.
CoinDesk31 January 2026
Step Finance discloses breach publicly on X (formerly Twitter), describes it as a compromise of 'several treasury wallets' by 'a sophisticated actor.' STEP token crashes approximately 93% within 24 hours.
CoinTelegraph via TradingView31 January 2026
CertiK confirms on-chain that 261,854 SOL was unstaked and transferred from Step Finance-controlled wallets to attacker-controlled addresses.
Rekt News2 February 2026
Step Finance confirms that the breach originated from the compromise of executive team members' devices.
Rekt News / Halborn Security24 February 2026
Step Finance announces permanent shutdown of all operations, citing inability to secure financing or acquisition after exhausting all strategic alternatives. SolanaFloor and Remora Markets also cease operations. STEP token falls an additional 34-36% on the announcement.
CoinDesk24 February 2026
Co-founder George Harrap states the shutdown is 'a difficult day' and prioritizes finding roles for team members. Step Finance announces a STEP token buyback program based on a pre-hack snapshot, and a separate Remora token redemption process. Approximately $4.7M in assets recovered through Token22 and Remora holdings.
The Record (Recorded Future News)Decision Log
- slot 426436829 · hash 6FzZQUpv8pSX4dsmES9qmKgcsvy5nTKYM7wYXnv4GwaL
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 14 of 15 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/14/2026, 2:43:03 PM
last updated: 6/14/2026, 2:43:03 PM
4 viewsavoid.net — verified advice for a post-truth world