Step Finance, a decentralized finance (DeFi) portfolio tracker built on Solana, said some of its treasury wallets were compromised in a security breach under active investigation.

Onchain data shared by blockchain security firm CertiK shows that 261,854 SOL, worth roughly $27 million at current prices, was unstaked and transferred during the incident.

The platform disclosed the breach in a post on X and asked cybersecurity firms to assist with the investigation. It did not specify how the attacker gained access or whether user funds were affected.

The platform's governance token, STEP, dropped over 80% in the last 24 hours, according to SoSoValue data. Step also operates a validator node on Solana and uses validator earnings to fund STEP token buybacks.

Founded in 2021, Step Finance aggregates yield farms, LP tokens and DeFi positions across nearly all Solana protocols into a single dashboard.

It also runs SolanaFloor, a Solana-focused media outlet, and organizes the Solana Crossroads conference. In late 2024, it acquired Moose Capital (now Remora Markets) and plans to offer tokenized equity trading on Solana.