Solana-based DeFi platform Step Finance announced on Monday that it will cease all operations, citing an unrecoverable security breach that drained approximately $40 million from its treasury and fee wallets. The closure also extends to its subsidiaries, including ecosystem media outlet SolanaFloor and tokenized equities platform Remora Markets.
In an X post, Step Finance explained that the team explored “every possible path forward, including financing and acquisition opportunities,” but was “unable to secure a viable outcome,” leading to an immediate shutdown. The company emphasized gratitude to its community, stating,
“We want to thank our millions of customers over the years for joining us on this journey.”
Today we are announcing that Step Finance, SolanaFloor, and Remora Markets will be winding down all operations.
— Step☀️ (@StepFinance_) February 23, 2026
Following the hack at the end of January we explored every possible path forward, including financing and acquisition opportunities.
Unfortunately, we were unable to…
January breach and operational vulnerabilities
The incident occurred on January 31, 2026, when attackers exploited devices used by Step Finance executives. This allowed unauthorized access to treasury and fee wallets, with approximately 261,854 SOL, initially valued at $27 million, unstaked and moved. Subsequent investigations estimated the total losses across all assets at nearly $40 million.
CertiK, a blockchain security firm, confirmed that the smart contract systems were not compromised; instead, the breach resulted from weak device security and operational vulnerabilities. Step Finance co-founder George Harrap acknowledged,
“Some people have reached out on acquiring various businesses, and we will pursue those if serious and have interest, but we are on a time crunch.”
The attack caused a severe collapse in confidence. STEP, the platform’s native token, lost nearly 96% of its value immediately following the breach and fell an additional 36% after the closure announcement. At present, the token trades at roughly $0.00060, down from an all-time high of $10.20 in August 2021, according to CoinGecko.
Buyback and redemption plans
Step Finance outlined plans for a buyback program for STEP holders, based on a snapshot of holdings before the January breach. The company has not yet released full details of the program.
Remora Markets, which remained operationally separate during the hack, confirmed that all rTokens remain backed 1:1. The platform is preparing a redemption process to allow rToken holders to exchange their tokens for USD Coin (USDC). In a statement, Remora said,
“All Remora rTokens remain fully backed 1:1,” and promised further information in the coming weeks.
Impact on Solana DeFi ecosystem
Step Finance was founded in 2021 as a portfolio visualization platform, aggregating yield farms, liquidity provider tokens, and other DeFi positions across 95% of Solana protocols. The platform also hosted the Solana Crossroads conference in Istanbul and acquired Moose Capital in December 2024, later rebranded as Remora Markets, to expand into tokenized equity trading.
The shutdown represents one of the largest platform-level failures on Solana in early 2026. Operational security failures, such as compromised devices and weak endpoint controls, can be as damaging as vulnerabilities in smart contracts.
The closure contributes to ongoing pressure on Solana’s decentralized finance ecosystem, where total value locked has declined 52% since its September peak, according to DeFiLlama. SOL prices also fell by 1.8% on Monday to $78, roughly 74% below their all-time high of $293 in January 2025.
Lessons for the industry
The Step Finance incident highlights the importance of robust security practices and operational oversight in cryptocurrency firms. Reliance on personal devices and weak internal controls can lead to losses that surpass recoverable assets.
Some money was recovered thanks to Solana's Token22 protections, but about $35 million was still missing. This shows how hard it is to recover money after a big breach.
The shutdown also raises questions about investor protections in the DeFi sector and emphasizes the value of transparent communication during crises. Step Finance has committed to providing updates on buyback and redemption procedures in the coming weeks.
Tanya Petrusenko
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
