Step Finance treasury wallets drained of about $40M; Solana platform later shuts down
Step Finance treasury and fee wallets
On Jan 31, 2026, Step Finance reported a breach of some of its treasury wallets. CertiK saw 261,854 SOL (about $27 million) unstaked and transferred, and Step later put the total near $40 million. SlowMist's hack database classifies the cause as a private key leak. Step, SolanaFloor and Remora Markets announced a wind-down on Feb 23, 2026, with a STEP buyback based on a pre-hack snapshot and a USDC redemption process for Remora rToken holders. Holders should use only official Step channels for the buyback and redemption.
Why this severity: $40M reported stolen.
- Started
- Jan 31, 2026
- Closed
- Jan 31, 2026
- Chains
- Solana
- Reported stolen
- $40M
At risk
- Step Finance treasury and fee wallets
- Solana wallets
What to do now
- Follow the STEP buyback and Remora rToken redemption only through Step's official accounts and site, reached from your own bookmarks.
- Ignore 'claim your refund' links in replies and DMs. Shutdown refunds are a favourite phishing lure.
Stay safe
Am I affected?
The stolen funds came from Step's own treasury and fee wallets. You are affected if you held STEP before the hack, or held Remora rTokens, because those holders get the buyback and redemption processes.
What to do now
- Follow the STEP buyback and Remora rToken redemption only through Step's official accounts and site, reached from your own bookmarks.
- Ignore 'claim your refund' links in replies and DMs. Shutdown refunds are a favourite phishing lure.
How to avoid this (for teams)
- Put treasury funds, and stake and withdraw authorities, behind a multisig whose signers use separate hardware wallets.
- Keep signing keys off everyday laptops and phones.
- Set alerts for large unstake or transfer events so a drain is caught while stake is still deactivating.
Timeline 2
Alerts & on-chain evidence 1
News & write-ups ›2
How this method works
A private key or seed phrase ends up somewhere readable: code on GitHub, an env file, a hacked server or cloud notes. Bots find it within minutes. Read about leaked private keys and seed phrases →
Follow new drains and updates in your feed reader or Telegram RSS bot.