Step Finance breach triggers $27M loss and 90% STEP crash

Step Finance disclosed a security breach affecting multiple treasury wallets, resulting in the unauthorised movement of more than $27 million worth of Solana onchain.

The Solana-based decentralised finance platform confirmed that the incident occurred during APAC hours and involved a sophisticated attacker exploiting a known attack vector.

“Earlier today several of our treasury wallets were compromised by a sophisticated actor during APAC hours. This was an attack facilitated through a well known attack vector,”

The Step Finance team said.

Step Finance added that remediation steps were taken shortly after the breach was identified, although details of those measures were not disclosed.

Onchain data reviewed by blockchain security firm CertiK showed that approximately 261,854 SOL was unstaked and transferred from wallets controlled by Step Finance.

Based on prevailing market prices, the moved funds were valued at around $27.2 million at the time of the transfers.

Step Finance has not confirmed the final scale of the losses and said investigations into the incident are ongoing.

The team did not clarify whether the breach resulted from compromised private keys, an internal access issue, or a vulnerability in smart contract infrastructure.

It also remains unclear whether any user funds were impacted, with current disclosures limited to protocol-owned treasury assets.

Market reaction to the disclosure was immediate, with the STEP governance token experiencing a sharp sell-off.

Data from CoinGecko showed that STEP fell by more than 90% within 24 hours of the announcement.

Founded in 2021, Step Finance markets itself as the “front page of Solana,” offering portfolio tracking and analytics for decentralised finance users.

The platform provides a unified dashboard that allows users to monitor yield farming positions, liquidity pools and token balances across Solana-based protocols.

Beyond its core product, Step Finance operates SolanaFloor, a media outlet focused on the Solana ecosystem.

The company also organises the annual Solana Crossroads conference, which brings together developers, investors and ecosystem participants.

In late 2024, Step Finance acquired Moose Capital, later rebranded as Remora Markets, to expand into tokenised equity trading on Solana.

The STEP token plays a central role in governance decisions and incentive mechanisms within the protocol.

Industry data suggests that most crypto projects struggle to recover after major security breaches.

Web3 security executives estimate that nearly 80% of projects affected by significant hacks fail to fully regain trust and market position.

“Most teams are unprepared for security incidents, which leads to hesitation, slow decision-making and weak communication in the critical hours after a breach,”

Immunefi chief executive Mitchell Amador said.

Security leaders warn that even when technical issues are resolved, reputational damage often results in user exits, liquidity losses and long-term credibility challenges.

At the time of reporting, Solana price was $104.73.