Step Finance Closes After Major Solana Hack

Step Finance has shut down its operations after a January hack drained up to $40 million from its treasury, forcing the closure of its core platform and affiliated projects.

Key Takeaways

• Step Finance, SolanaFloor, and Remora Markets are ceasing operations effective immediately.
• A January 31 breach drained 261,854 SOL, with total losses later estimated at nearly $40 million.
• The hack targeted executive devices, not smart contracts, exposing operational security gaps.
• The team is preparing a STEP token buyback and a Remora rToken redemption process.

What Happened?

Solana based DeFi aggregator Step Finance announced on February 24 that it will shut down its platform following a devastating treasury hack in late January. The decision also impacts its affiliated media outlet SolanaFloor and lending protocol Remora Markets.

Despite exploring financing and acquisition options, the company said it was unable to secure a sustainable path forward after suffering multimillion dollar losses.

January Hack Drained Treasury Funds

The breach occurred on January 31, 2026, when attackers compromised devices used by members of Step Finance’s executive team. According to the company, the exploit did not target smart contracts. Instead, hackers gained access to treasury and fee wallets through compromised endpoints.

During the attack, approximately 261,854 SOL was unstaked and withdrawn. Initial estimates valued the stolen assets between $27 million and $30 million, though later assessments put total losses across assets at nearly $40 million.

Security firm CertiK previously estimated the loss at around $29 million, underscoring the scale of the incident.

Step Finance said it worked with partners and relied on Solana’s Token22 protections to recover about $4.7 million, but the amount retrieved was not enough to restore financial stability.

The incident has drawn attention to how crypto companies manage private keys and executive level device security. Investigators clarified that the weakness was operational rather than structural, meaning internal security controls failed rather than blockchain infrastructure.

Shutdown Extends to SolanaFloor and Remora Markets

The fallout extends beyond Step Finance’s core dashboard product. The shutdown includes SolanaFloor, an early Solana ecosystem media platform, and Remora Markets, a lending and tokenized product protocol linked to Step.

SolanaFloor said it will stop publishing new content but keep its website, videos, and newsletters online as an archive. The outlet stated it attempted to continue operations independently but could not find a sustainable route after its parent company’s financial setback.

Remora Markets confirmed that all rTokens remain fully backed on a one to one basis and that holders will be able to redeem them for USD Coin USDC through a forthcoming redemption process.

“All Remora rTokens remain fully backed 1:1,” the company said, adding that more details will be shared in the coming weeks.

Token Collapse and Market Impact

The hack triggered a sharp loss of confidence across the ecosystem. Step Finance’s native STEP token fell more than 97 percent from recent levels. At the time of writing, STEP was trading at $0.00058, down 37.8 percent in a single day and 97.6 percent over the past month. At its peak in April 2021, the token reached $10.20, according to CoinGecko.

Image Credit – CoinGecko.com

Step Finance was one of Solana’s original DeFi infrastructure projects. Its portfolio dashboard helped users track wallets, liquidity positions, yield strategies, and on chain activity in one place.

The closure marks another setback for the broader Solana decentralized finance ecosystem. Total value locked across the network has reportedly fallen 50 percent from its September peak and now stands at $6.28 billion.

The shutdown also follows other recent closures in the space. In February, ZeroLend announced a complete shutdown, and the team behind the analytics service Parsec declared it was closing after five years of operation.

CoinLaw’s Takeaway

In my experience, this case shows that crypto risks are not limited to smart contracts. Even when blockchain code is secure, weak operational controls can bring down an entire company. I found it striking that executive device security, something many firms overlook, became the critical failure point here.

For users, this is another reminder that treasury management and internal safeguards matter just as much as audits. For the Solana ecosystem, losing an early infrastructure name like Step Finance feels significant. It highlights how fragile confidence can be when large losses hit suddenly.

The industry continues to mature, but episodes like this prove there is still work to do in strengthening internal security standards.

The post Step Finance Closes After Major Solana Hack appeared first on CoinLaw.