Audit log

Every state-changing event for Step Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-05-19 20:04:09Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,837,892

   sig

   1qR9EBdnLfyD…4a2Eo18Rcopyexplorer ↗

   hash

   AN2YkoGqZPjd…STb9wrfRcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (7764 B) ▸

   {"actor":"system:backfill","investigation_id":"6670b7ec-4df8-4b8c-8b6d-d167cc148fd6","kind":"publish","page_slug":"step-finance","published_at":"2026-05-19T20:04:09.377Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Step Finance","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://solanacompass.com/projects/step-finance"},{"credibility":3,"name":"","type":"other","url":"https://www.crypto-news-flash.com/george-harraps-journey-from-bitspark-to-step-finance-on-solana/"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/bitspark-shuts-down-amid-restructuring-coronavirus-and-protests"},{"credibility":3,"name":"","type":"other","url":"https://stepfinance.medium.com/step-group-2026-remora-solanafloor-and-more-22045e77fbd7"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://docs.step.finance/"},{"credibility":3,"name":"","type":"other","url":"https://solanabox.tools/tools/step-finance"},{"credibility":3,"name":"","type":"other","url":"https://solanafloor.com/news/step-finance-enters-rwa-sector-third-acquisition"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-step-finance-hack-january-2026"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/step-finance-says-compromised-execs-devices-led-to-40m-crypto-theft/"},{"credibility":3,"name":"","type":"other","url":"https://www.assuredefi.com/blog/step-finance-hack-explained-40m-executive-device-breach"},{"credibility":3,"name":"","type":"other","url":"https://cryptonews.com/news/30m-stolen-as-step-finance-treasury-wallets-compromised/"},{"credibility":3,"name":"","type":"other","url":"https://www.govinfosecurity.com/cryptohack-roundup-step-finance-shuts-down-after-exploit-a-30855"},{"credibility":3,"name":"","type":"other","url":"https://www.scworld.com/brief/step-finance-loses-40-million-in-executive-device-hack"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/author/george-harrap/"},{"credibility":3,"name":"","type":"other","url":"https://www.crunchbase.com/person/george-harrap-e876"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/bitspark-shuts-down-amid-restructuring-coronavirus-and-protests"},{"credibility":3,"name":"","type":"other","url":"https://solana.com/zh/validated/episodes/george-harrap-co-founder-of-step-finance-ep-45"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://docs.step.finance/step-tokenomics"},{"credibility":3,"name":"","type":"other","url":"https://stepfinance.medium.com/step-tokenomics-83825705cd8"},{"credibility":3,"name":"","type":"other","url":"https://coinmarketcap.com/currencies/step-finance/"},{"credibility":3,"name":"","type":"other","url":"https://www.turkishnyradio.com/step-finance-shutdown-sparks-buyback-plan-for-step-holders/"},{"credibility":3,"name":"","type":"other","url":"https://coinfomania.com/step-holders-get-buyback-as-solana-projects-shut-down/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://solana.com/ecosystem/stepfinance"},{"credibility":3,"name":"","type":"other","url":"https://www.crowdfundinsider.com/2026/02/263817-step-finance-ceases-operations-following-40-million-security-incident/"},{"credibility":3,"name":"","type":"other","url":"https://cryptopotato.com/the-end-of-step-finance-how-a-wallet-compromise-killed-the-solana-defi-aggregator/"},{"credibility":3,"name":"","type":"other","url":"https://therecord.media/step-finance-cryptocurrency-theft-shutdown"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2026/02/24/step-finance-shuts-operations-after-usd27-million-january-hack"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/390964/step-finance-shuts-down"},{"credibility":3,"name":"","type":"other","url":"https://finance.yahoo.com/news/step-finance-solanafloor-shut-down-021611434.html"},{"credibility":3,"name":"","type":"other","url":"https://www.tomshardware.com/tech-industry/cyber-security/usd40-million-worth-of-crypto-stolen-from-step-finance-hackers-compromise-executives-devices-to-gain-illicit-access"},{"credibility":3,"name":"","type":"other","url":"https://www.ainvest.com/news/step-finance-hack-27m-liquidity-drain-token-collapse-2602/"}]}],"sources_used":[],"summary":"Step Finance was a Solana-based DeFi portfolio management and analytics platform founded by George Harrap that operated from 2021 until February 2026. On January 31, 2026, attackers compromised executive team devices and drained approximately $40 million in treasury assets, representing a catastrophic operational security failure. The platform was unable to secure financing or an acquisition to continue operating and formally shut down on February 23, 2026, along with affiliated projects SolanaFloor and Remora Markets.","timeline":[{"date":"2014-01-01","event":"George Harrap co-founds Bitspark, a blockchain remittance startup in Hong Kong.","source":""},{"date":"2020-02-03","event":"Bitspark announces shutdown following co-founder Maxine Ryan's departure and restructuring failure, with COVID-19 and Hong Kong protests cited as exacerbating factors.","source":""},{"date":"2021-04-01","event":"Step Finance launches on Solana, positioning itself as a unified portfolio dashboard for the Solana DeFi ecosystem.","source":""},{"date":"2021-09-12","event":"STEP token reaches its approximate all-time high price.","source":""},{"date":"2021-10-01","event":"Step Finance executes a 37% total supply burn, reducing the STEP token supply from 1 billion.","source":""},{"date":"2021-10-13","event":"STEP staking goes live via the xSTEP mechanism, the first xSUSHI-style staking contract on Solana.","source":""},{"date":"2025-12-01","event":"Step Finance publishes Step Group 2026 roadmap, outlining expansion plans across Step Finance, SolanaFloor, and Remora Markets.","source":""},{"date":"2026-01-31","event":"Critical security breach: attackers compromise executive team devices and drain approximately $40 million (261,854+ SOL) from Step Finance treasury and fee wallets during APAC hours.","source":""},{"date":"2026-01-31","event":"CertiK flags the illicit withdrawal of approximately 261,854 SOL (~$28.9 million) from Step Finance wallets.","source":""},{"date":"2026-02-01","event":"Step Finance confirms the breach publicly, halts operations, engages cybersecurity professionals, and notifies authorities. Revised total loss estimated at ~$40 million.","source":""},{"date":"2026-02-01","event":"Approximately $4.7 million recovered through ecosystem partner coordination ($3.7M in Remora assets, $1M in other positions).","source":""},{"date":"2026-02-23","event":"Step Finance announces immediate wind-down of all operations, including SolanaFloor and Remora Markets, citing inability to secure financing or acquisition after exhausting all options.","source":""},{"date":"2026-02-23","event":"STEP token drops over 37% on the shutdown announcement, with cumulative losses from pre-breach levels reaching approximately 97%.","source":""},{"date":"2026-02-23","event":"Step Finance announces buyback program for STEP holders using a pre-breach snapshot, and a structured USDC redemption process for Remora rToken holders. Terms not yet finalized.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e5944254-6309-45ad-aae9-62ab3d47d339copy
2. #2reviewby reviewerreviewer

   2026-06-15 19:50:06Z
   Score: 12 → 12 (no score change)
   The Step Finance page is largely accurate. The core narrative — executive device compromise on January 31, 2026 draining $40M and leading to February 23, 2026 shutdown of Step Finance, SolanaFloor, and Remora Markets — is confirmed across multiple tier-1 sources. The main factual error is the all-time high date (listed as September 12, 2021 when the true ATH was April 2021 near launch). One source URL (Cointelegraph on Bitspark) returned 404. Dollar amounts for the hack vary across credible outlets ($27-40M) due to the difference between SOL spot value at time of theft vs. Step Finance's revised total including non-SOL assets; the page's $40M is defensible as Step Finance's own figure but creates ambiguity. The entity is unambiguously a victim of an external attack with no evidence of own-fraud.
   anchoranchored

   chain

   ●mainnet-betaslot 426,700,996

   sig

   EbD66JnPy6Y5…WemHhzeZcopyexplorer ↗

   hash

   2eQfRYpV3FjC…xEC4Nb55copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1154 B) ▸

   {"actor":"reviewer","decided_at":"2026-06-15T19:50:06.249Z","decision":"review","investigation_id":"6670b7ec-4df8-4b8c-8b6d-d167cc148fd6","new_score":12,"page_slug":"step-finance","prev_score":12,"reason":"The Step Finance page is largely accurate. The core narrative — executive device compromise on January 31, 2026 draining $40M and leading to February 23, 2026 shutdown of Step Finance, SolanaFloor, and Remora Markets — is confirmed across multiple tier-1 sources. The main factual error is the all-time high date (listed as September 12, 2021 when the true ATH was April 2021 near launch). One source URL (Cointelegraph on Bitspark) returned 404. Dollar amounts for the hack vary across credible outlets ($27-40M) due to the difference between SOL spot value at time of theft vs. Step Finance's revised total including non-SOL assets; the page's $40M is defensible as Step Finance's own figure but creates ambiguity. The entity is unambiguously a victim of an external attack with no evidence of own-fraud.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ac202b8f-77c0-435f-b8f1-6e59a0c9fd39copy
3. #3review approveby judgejudge

   2026-06-15 19:50:06Z
   Score: 12 → 52 (+40)
   The review confirmed 13 of 19 claims outright, with 4 partially supported and only 1 disputed (claim_findings[9]: the STEP all-time high date, listed as September 12, 2021, is contradicted by CoinGecko and CoinCodex, which place the true ATH in April 2021). This is a peripheral data point — it does not affect the core narrative. The entity is an unambiguous hack victim: an external attacker compromised executive devices on January 31, 2026, draining 261,854 SOL confirmed across multiple Tier 1 sources (BleepingComputer, The Record, Decrypt, CoinDesk). There is no evidence of own-fraud, exit scam, or insider misappropriation. The current score of 12 (CRITICAL) conflicts directly with the scoring rubric, which reserves CRITICAL for confirmed large-scale fraud and caps suffered-hack events at the CAUTIONARY band. The reviewer's recommended score of 52 (CAUTIONARY) is well-supported. A calibration correction to 52 is warranted; this review approves the page content as substantially accurate.
   anchoranchored

   chain

   ●mainnet-betaslot 426,701,003

   sig

   5TeHpF8XK62M…mTuFnoHDcopyexplorer ↗

   hash

   F2YpibrDgk5o…SNJ3tuMGcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1356 B) ▸

   {"actor":"judge","decided_at":"2026-06-15T19:50:06.249Z","decision":"review_approve","investigation_id":"6670b7ec-4df8-4b8c-8b6d-d167cc148fd6","new_score":52,"page_slug":"step-finance","prev_score":12,"reason":"The review confirmed 13 of 19 claims outright, with 4 partially supported and only 1 disputed (claim_findings[9]: the STEP all-time high date, listed as September 12, 2021, is contradicted by CoinGecko and CoinCodex, which place the true ATH in April 2021). This is a peripheral data point — it does not affect the core narrative. The entity is an unambiguous hack victim: an external attacker compromised executive devices on January 31, 2026, draining 261,854 SOL confirmed across multiple Tier 1 sources (BleepingComputer, The Record, Decrypt, CoinDesk). There is no evidence of own-fraud, exit scam, or insider misappropriation. The current score of 12 (CRITICAL) conflicts directly with the scoring rubric, which reserves CRITICAL for confirmed large-scale fraud and caps suffered-hack events at the CAUTIONARY band. The reviewer's recommended score of 52 (CAUTIONARY) is well-supported. A calibration correction to 52 is warranted; this review approves the page content as substantially accurate.","score_delta":40,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 877a41aa-3054-481d-babc-037ee64a5e49copy