Step Finance Treasury Drain

On January 31, 2026, the Solana DeFi portfolio tracker Step Finance lost 261,854 SOL — approximately $27 million at the time — when a "sophisticated actor" compromised several treasury and fee wallets. The STEP token fell 96%. Three weeks later, Step Finance announced the permanent shutdown of its operations, along with its affiliated projects SolanaFloor (a Solana media outlet) and Remora Markets (a tokenisation platform).

What happened

Step Finance — founded in 2021 — was one of the longest-running Solana DeFi products. The platform aggregated yield-farm positions, LP tokens and DeFi positions across nearly all Solana protocols into a single user-facing dashboard. Over its 4-year history it had accumulated a meaningful treasury from fee revenue and token operations.

The breach targeted the treasury and fee wallets specifically — not user-facing custody (Step Finance was a portfolio tracker, not a custodian, so user funds were largely held in users' own wallets). The attacker compromised multiple wallet addresses and drained their SOL holdings in a coordinated sweep totalling 261,854 SOL (~$27M).

Step Finance described the compromise as the work of a "sophisticated actor" but did not publicly detail the technical vector. The on-chain pattern was consistent with private-key extraction from the team's signing infrastructure rather than smart-contract exploitation.

Aftermath

• The STEP token immediately fell ~96% as the market priced in the protocol's reduced runway and uncertain future.
• Step Finance announced they had "explored every possible path forward, including financing and acquisition opportunities" but couldn't secure a viable outcome.
• On February 24, 2026 — three weeks post-hack — Step Finance announced permanent operations shutdown.
• SolanaFloor (the affiliated media outlet) and Remora Markets (tokenisation platform) also shut down at the same time, as both depended on Step Finance's parent organisation.
• STEP token fell a further 36% on the closure announcement.
• No public recovery from the attacker's wallets.

Why it matters

The Step Finance shutdown is a striking 2026 case for how a treasury hack at a non-custodial DeFi product can still kill the protocol. Step Finance didn't lose user funds in the typical sense — users' assets sat in their own wallets — but the project itself lost the operating capital and runway that funded ongoing development and operations.

The structural lessons:

1. Treasury custody for DeFi protocols requires the same security rigor as user-facing custody. The "we're decentralised, users hold their own funds" framing breaks down when the team's own operating capital is what gets drained.

2. Long-running protocols accumulate meaningful treasury value that increases their attractiveness as targets over time. Step Finance's 4+ years of operations meant their treasury held substantially more than a newer protocol's would — and the same loose operational security that was tolerable at $1M treasury becomes catastrophic at $27M.

3. Affiliated-projects ecosystems share parent-organisation operational risk. SolanaFloor and Remora Markets weren't directly affected by the Step Finance treasury breach, but they depended on the same parent for runway — and went down with it.

The Step Finance closure is one of several 2026 "operational shutdown after treasury hack" events. The pattern — sophisticated key compromise → too large a loss to absorb from remaining runway → orderly wind-down rather than partial-operation continuation — has become the standard outcome for non-custodial DeFi products whose ops capital depends on a stable team-controlled treasury.