Solana-based Step Finance shuts down after $40M January hack

Step Finance is shutting down its Solana-based platforms after a January hack drained up to $40 million and undermined its financial stability.
- Step Finance will cease operations after a major security breach.
- The January hack targeted executive devices, not smart contracts.
- Buybacks and token redemptions are being prepared.
In a statement shared on Feb. 24 on X, the company said it would shut down its core platform alongside SolanaFloor and Remora Markets, effective immediately.
The decision follows a hack in late January that resulted in losses estimated at up to $40 million. Despite efforts to secure funding or pursue an acquisition, the team said no viable path forward could be found.
“We explored every possible path forward,” Step Finance said. “Unfortunately, we were unable to secure a sustainable outcome.”
January breach and financial fallout
The incident occurred on Jan. 31, 2026, when attackers exploited devices used by members of Step Finance’s executive team. They then gained access to the treasury and fee wallets, giving them control to move and withdraw substantial amounts of digital assets.
Investigators later clarified that the platform’s smart contract was not the target. Instead, the breach stemmed from compromised endpoints and weak device security. In other words, the issue was operational, not structural.
The episode draws attention to how cryptocurrency companies handle private keys and manage bring-your-own-device practices. When those controls fall short, the consequences can be severe.
During the attack, about 261,854 SOL, initially valued between $27 million and $30 million, was unstaked and moved. Later assessments put the total losses across various assets at nearly $40 million.
Working with partners and relying on Solana’s Token22 protections, the team was able to recover roughly $4.7 million. Even so, the amount retrieved fell short of what was needed to restore stability to operations.
The hack triggered a sharp collapse in confidence. The platform’s native STEP token reportedly fell by more than 97%, wiping out much of its market value and making fundraising increasingly difficult.
Buybacks, redemptions, and user protections
As part of the shutdown process, Step Finance said it is working on a buyback program for STEP holders. The plan will be based on a snapshot taken before the January breach, although full details have not yet been released.
Remora Markets issued a separate statement confirming that all rTokens remain fully backed on a one-to-one basis. The company is preparing a redemption process that will allow holders to exchange their tokens for USD Coin (USDC).
“All Remora rTokens remain fully backed 1:1,” the company said, adding that more information will be shared in the coming weeks.
The shutdown affects several products that were widely used within the Solana (SOL) ecosystem, including portfolio tracking tools, market data services, and tokenized equity products.
Company leaders thanked users for their support, saying the shutdown was the most responsible course of action given the financial strain and operational setbacks.
The collapse of Step Finance stands as one of the largest platform-level failures in early 2026. Observers across the industry note that weaknesses outside the blockchain can be just as destructive as flaws in smart contracts.
Even established platforms remain vulnerable when internal controls are not strong enough.




