Step Finance, SolanaFloor & Remora Shut Down After Hack

Step Finance, SolanaFloor, and Remora shut down after a $40M hack, with token buybacks and rToken redemptions now planned.

A month after a major security incident, Step Finance and its affiliated platforms have confirmed they will wind down all operations.

The team said the decision followed unsuccessful attempts to secure new funding or complete an acquisition after a breach that removed about $40 million from its treasury.

Security Incident Ends Recovery Efforts

Step Finance suffered a major security breach on January 31, 2026, when attackers gained unauthorized access to treasury-linked wallets and withdrew roughly 261,854 SOL, worth about $29 million. 

The funds were unstaked and transferred rapidly, suggesting coordinated control.

The root cause remains unknown, and despite bringing in external security teams, Step Finance was unable to recover financially.

After attempts to secure funding or an acquisition failed, the project and its affiliated platforms, SolanaFloor and Remora Markets, announced a full shutdown.

In an announcement on X, the team confirmed that these options did not produce a viable path forward.

They said the incident placed the platform under strain that could not be resolved, even with outreach to multiple partners. The shutdown applies to Step Finance and its wider group of integrated services.

The team noted that it had been working to stabilize operations while searching for a solution, but the losses from the attack ultimately made the effort unworkable.

The decision ends activity across several business units connected to the main platform.

SolanaFloor and Remora Included in Shutdown

The closure includes SolanaFloor and Remora Markets. SolanaFloor, known for its reports and coverage of the Solana ecosystem, will keep a digital archive of its existing content.

However, it will stop publishing new newsletters or analytics moving forward, according to a separate statement.

Remora Markets, which focuses on tokenized equities, will also end operations.

The team said Remora was not affected by the January security breach because it operated in isolation from Step Finance’s treasury systems.

Remora tokens remain backed 1:1, and the project is preparing a redemption process for rToken holders.

Step Finance said it is also preparing a buyback program for STEP holders. The buyback will use a snapshot taken before the exploit, and more information will be provided as the process develops.

Related Reading:  Solana Dominates Network Transactions Across All Chains in 2025

End of Operations for a Long-Running Solana Tool

Step Finance began in 2021 as a Solana portfolio manager that aggregated positions across many protocols.

It allowed users to track liquidity pools, yield farms, and assets from one dashboard.

The company expanded during the 2021 cycle and later acquired Moose Capital, which became Remora Markets, to add tokenized equity products.

The shutdown affects its user base across several regions. In its statement, the team thanked its customers and said it believed the decision was the best outcome based on current conditions.

STEP has fallen sharply since the announcement, and market data now shows a much smaller valuation for the token.

As LiveBitcoin reported earlier, STEP fell more than 60% to roughly $0.023 after the breach, as traders reacted to uncertainty over treasury losses and concerns that missing SOL could hinder validation rewards and STEP buybacks that support xSTEP stakers.

The incident came during a broader market downturn, with CertiK reporting $370.3 million stolen across the crypto sector last month, mostly from phishing attacks and code vulnerabilities, while recovery of lost funds has remained limited.

The post Step Finance, SolanaFloor & Remora Shut Down After Hack appeared first on Live Bitcoin News.