# Step Finance treasury wallets drained of about $40M; Solana platform later shuts down

- Severity: Critical · Status: Contained (past)
- Chains: Solana · Method: Leaked private keys and seed phrases
- Started: Jan 31, 2026 · Last update: Feb 23, 2026 · Reported stolen: $40M
- Who/what: Step Finance treasury and fee wallets

On Jan 31, 2026, Step Finance reported a breach of some of its treasury wallets. CertiK saw 261,854 SOL (about $27 million) unstaked and transferred, and Step later put the total near $40 million. SlowMist's hack database classifies the cause as a private key leak. Step, SolanaFloor and Remora Markets announced a wind-down on Feb 23, 2026, with a STEP buyback based on a pre-hack snapshot and a USDC redemption process for Remora rToken holders. Holders should use only official Step channels for the buyback and redemption.

## Am I affected?
The stolen funds came from Step's own treasury and fee wallets. You are affected if you held STEP before the hack, or held Remora rTokens, because those holders get the buyback and redemption processes.

## What to do now
- Follow the STEP buyback and Remora rToken redemption only through Step's official accounts and site, reached from your own bookmarks.
- Ignore 'claim your refund' links in replies and DMs. Shutdown refunds are a favourite phishing lure.

## How to avoid this (for teams)
- Put treasury funds, and stake and withdraw authorities, behind a multisig whose signers use separate hardware wallets.
- Keep signing keys off everyday laptops and phones.
- Set alerts for large unstake or transfer events so a drain is caught while stake is still deactivating.

## Sources
- Step Finance shuts down following $40 million security breach (The Block, 2026-02-24): https://www.theblock.co/post/390964/step-finance-shuts-down
- 3 Solana platforms to shutter following devastating $40M hack (Cointelegraph, 2026-02-24): https://cointelegraph.com/news/step-finance-solanafloor-remora-markets-wind-down-operations
- SlowMist Hacked: Solana incidents (Step Finance) (SlowMist, 2026-01-31): https://hacked.slowmist.io/?c=Solana

Full record: https://drains.watch/i/step-finance-treasury-drain-jan-2026 · JSON: https://drains.watch/i/step-finance-treasury-drain-jan-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.