{
 "tag": "staking",
 "name": "Staking",
 "group": "Other",
 "incidents": [
  {
   "slug": "step-finance-treasury-drain-jan-2026",
   "title": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down",
   "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026",
   "json": "https://drains.watch/i/step-finance-treasury-drain-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "key-leak",
   "product": "Step Finance treasury and fee wallets",
   "tags": [
    "solana",
    "key-leak",
    "treasury",
    "team-wallet",
    "private-key",
    "step-finance",
    "solanafloor",
    "remora",
    "staking"
   ],
   "amountUsd": 40000000,
   "victims": null,
   "startedAt": "2026-01-31",
   "closedAt": "2026-01-31",
   "updatedAt": "2026-02-23T12:00:00Z",
   "summary": "On Jan 31, 2026, Step Finance reported a breach of some of its treasury wallets. CertiK saw 261,854 SOL (about $27 million) unstaked and transferred, and Step later put the total near $40 million. SlowMist's hack database classifies the cause as a private key leak. Step, SolanaFloor and Remora Markets announced a wind-down on Feb 23, 2026, with a STEP buyback based on a pre-hack snapshot and a USDC redemption process for Remora rToken holders. Holders should use only official Step channels for the buyback and redemption."
  }
 ],
 "changes": [
  {
   "incident": "step-finance-treasury-drain-jan-2026",
   "incidentTitle": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-02-23",
   "title": "Step Finance said it would end operations along with SolanaFloor and Remora Markets after the roughly $40M loss.",
   "sourceUrl": "https://www.theblock.co/post/390964/step-finance-shuts-down",
   "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026"
  },
  {
   "incident": "step-finance-treasury-drain-jan-2026",
   "incidentTitle": "Step Finance treasury wallets drained of about $40M; Solana platform later shuts down",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-31",
   "title": "Step Finance reported a breach of some treasury wallets; CertiK reported 261,854 SOL (about $27M) unstaked and transferred.",
   "sourceUrl": "https://cointelegraph.com/news/step-finance-solanafloor-remora-markets-wind-down-operations",
   "url": "https://drains.watch/i/step-finance-treasury-drain-jan-2026"
  }
 ]
}