Step Finance Hack Drains $30M SOL; STEP Token Crashes on Solana DeFi Breach

Step Finance on Solana suffered a treasury breach draining 261,854 SOL (~$27–$30M), triggering an 80–90% drop in STEP as investigators probe the incident.

Rich by Coin

2026-02-01

Step Finance, a Solana-based portfolio management platform, suffered a security breach on January 31, 2026, with attackers gaining unauthorized access to treasury wallets and stealing approximately 261,854 SOL tokens valued at about $27–$30 million. The attackers bypassed smart contracts and drained funds by directly accessing treasury wallets, unstaking and transferring the SOL to an unknown address. Step Finance confirmed the attack on its official X account but provided limited details, leaving the community to speculate about the exploitation method. The incident suggests possible private-key compromise or weaknesses in wallet security or access-control mechanisms, and Step Finance has engaged cybersecurity firms for a forensic investigation with an unclear timeline; early indications suggest only the treasury was affected.

The cryptocurrency market reacted quickly, with STEP collapsing by more than 80–90% in the 24 hours after the announcement, reflecting concerns about security and platform viability. The platform’s revenue stream from its validator node, historically used for token buybacks to support STEP’s price, has been severely compromised by the treasury depletion. Step Finance paused certain protocol operations and is tracing the stolen funds, exploring recovery options such as negotiation, legal action, or exchange-level freezes. Investigators will analyze on-chain movement of the 261,854 SOL to determine where the funds are held and whether recovery is possible; recovery remains far from guaranteed if funds moved across exchanges or mixers.

The breach comes amid rapidly expanding institutional adoption on Solana, underscoring the need for robust treasury security and stronger access controls. It offers critical lessons for DeFi: treat treasury security with the same rigor as smart-contract security, implement multi-signature wallets, hardware security modules, time-locked access, and regular security audits, and ensure cyber insurance and pre-arranged forensic and legal support. Step Finance now faces rebuilding trust and must provide transparent updates and security upgrades to prevent future incidents, with success depending on regaining community confidence.