Step Finance, the Solana-based DeFi aggregator, along with SolanaFloor and Remora Markets, announced plans to shut down all operations with immediate effect. The decision follows the aftermath of a major security incident earlier this year. In a statement posted on X, the teams explained they explored multiple paths forward, including fundraising and acquisition discussions, but none provided a viable path forward after the late-January hack.
The incident involved an estimated $30 million in assets drained from Step Finance’s wallets on the Solana network. Disclosures indicated the breach stemmed from compromised devices belonging to members of the project’s executive team, likely exposing private keys or enabling malware that interfered with internal transaction approvals and allowed attackers to initiate and approve malicious on-chain transactions. Once access was obtained, the attackers unstaked roughly 261,854 SOL and transferred the funds out of project-controlled wallets. This triggered a sharp market reaction, with the STEP token falling by more than 80%.
Following detection of the exploit, the team halted certain components of the platform to limit further damage and later reported that approximately $4.7 million in Remora-related assets and other holdings were recovered. As part of the shutdown process, Step Finance said it is working on a buyback program for STEP token holders based on a snapshot taken prior to the incident, while Remora Markets is preparing a redemption process for rToken holders. The hack ranks among the costliest DeFi incidents in January 2026, underscoring a broader rise in crypto-related losses over the past year.
Leave a Reply