Jan 31, 2026
1 new drain, 1 update.
New
-
Critical✓Contained
Step Finance treasury wallets drained of about $40M; Solana platform later shuts down
On Jan 31, 2026, Step Finance reported a breach of some of its treasury wallets. CertiK saw 261,854 SOL (about $27 million) unstaked and transferred, and Step later put the total near $40 million. SlowMist's hack database classifies the cause as a private key leak. Step, SolanaFloor and Remora Markets announced a wind-down on Feb 23, 2026, with a STEP buyback based on a pre-hack snapshot and a USDC redemption process for Remora rToken holders. Holders should use only official Step channels for the buyback and redemption.
Step Finance treasury and fee wallets·Solana·$40M stolen·Since Jan 31, 2026·
Updated
-
Critical✕Still active
Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier
On 30 January 2026 a victim sent 4,556 ETH, about $12.25M, to a lookalike of a regular counterparty's address. The attacker had seeded it into the victim's history with fake token transfers from February 2025 and ETH dust from October 2025; it matched the real address's first and last four characters. About 33 minutes later the ETH was swept to a new wallet, and the next day all of it went into Tornado Cash. Scam Sniffer flagged the loss.
Ethereum whale wallet·Ethereum·$12M stolen·Since Jan 30, 2026·