$30M Stolen from Step Finance Treasury Wallets

Step Finance, a well-known decentralized finance (DeFi) platform on the Solana blockchain, recently reported that multiple treasury and fee wallets were breached by a skilled attacker. This incident led to the theft of around 261,854 SOL tokens, valued at approximately $30 million.

Key Takeaways

Step Finance confirmed a breach of its treasury and fee wallets, resulting in the loss of $30 million worth of SOL tokens.
The stolen assets were moved after stake authorization was compromised, raising concerns among users and the market.
The attack had immediate repercussions, with the STEP token crashing over 90% in value.
The incident is part of a broader trend of security breaches in the DeFi space, with millions lost in various exploits during January 2026.

$30M Stolen from Step Finance Treasury Wallets

Blockchain security firm CertiK highlighted that the stolen SOL was moved after the attacker gained control over the staking authorization and transferred it to an unknown wallet address. The news caused significant turmoil within the Solana ecosystem, leading to a rapid drop of over 90% in the value of the platform's native token, STEP, within just 24 hours.

Step Finance Treasury Wallets Compromised - STEP Price Chart

While Step Finance maintains that user funds were not affected, many are questioning whether this incident is a serious security breach or a potential exit scam. Observers noted that the attacker seemed to have direct access to the wallets instead of leveraging any vulnerabilities within the smart contracts.

Emergency Response and Damage Control

Step Finance quickly alerted the community about the security breach via social media, stating that “several of our treasury and fee wallets were compromised by a sophisticated actor” and confirming that the attack utilized “a well-known attack vector.”

In response to the breach, Step Finance initiated emergency measures, collaborating with cybersecurity experts for support. Reports from Solana media outlet Solana Floor indicated that on-chain activity showed the 261,854 SOL tokens were “unstaked and moved during the incident,” which implies that the attacker had gained access to the staking permissions.

The team has stated that they have “notified the relevant authorities” and taken immediate corrective actions while working with security professionals continuously.

Ripple Effects on Associated Platforms

The repercussions of the hack extended beyond Step Finance, impacting related platforms like Remora Markets. Remora acknowledged that “as the majority LP, Step Finance experienced a hack of treasury wallets earlier today,” affecting some of its assets, including Remora rStocks.

Despite the incident, Remora assured its users that “Remora assets remain held 1:1 in our brokerage account” and is developing a plan for handling redemptions.

The swift reaction in the market reflected doubt about Step Finance’s future, as traders quickly divested from the STEP token amid growing concerns about the platform's legitimacy and security.

January’s Unyielding Wave of DeFi Exploits

The hack of Step Finance is the latest in a series of distressing incidents for cryptocurrency security in January 2026. According to CertiK’s detailed security report for the month, an alarming total of approximately $370.3 million was lost due to various exploits.

Some notable incidents in January included Truebit’s $26.6 million exploit, SwapNet’s breach costing $13.3 million, and Saga’s $6.2 million setback that forced a pause on its SagaEVM chain. Additionally, Makina Finance suffered a $4.2 million loss due to flash loan manipulation.

CertiK's analysis reveals that phishing attacks alone accounted for $311.3 million out of January's total losses, while code vulnerabilities were responsible for an additional $51.5 million.

This breach is part of a worrying trend affecting Solana-based protocols. In September 2025, the Swiss crypto platform SwissBorg lost $41.5 million in SOL after hackers targeted its API partner, Kiln. Similarly, South Korea’s Upbit exchange faced a $36 million exploit on Solana the following November, six years after a hack attributed to North Korean actors.

In January, the cryptocurrency space faced the largest single theft in 2026, involving over $282 million worth of Bitcoin and Litecoin lost through a social engineering scam aimed at a hardware wallet. The perpetrator immediately started converting the stolen assets into Monero across various instant exchanges, complicating tracking efforts.

CertiK noted that so far, less than 2-5% of stolen assets have been recovered, as investigations into these incidents are just beginning.

Additionally, scrutiny has reached government-held crypto assets, with the US Marshals Service confirming an investigation into a potential breach involving federal digital-asset accounts. Patrick Witt, the executive director of the President’s Council of Advisors for Digital Assets, mentioned that the addresses used in the government seizures were among those from which hackers had stolen over $60 million in late 2025.