Solana DeFi Platform Step Finance Shuts Down Operations Following $40M Treasury Hack

Step Finance, a decentralized finance (DeFi) dashboard on the Solana blockchain, has announced the immediate cessation of all operations following a late-January security breach that resulted in the loss of approximately $40 million in assets from its treasury.

The shutdown, confirmed on February 23, encompasses its subsidiary platforms, SolanaFloor and Remora Markets. The decision comes after the team explored financing and acquisition opportunities but failed to secure a viable path forward. Remediation efforts are underway, including a buyback for STEP token holders based on a pre-incident snapshot and a redemption process for Remora rToken holders.

Operation Shutdown and Immediate Context

Step Finance, a Solana-based DeFi portfolio aggregator, formally announced on February 23, 2026, that it is ending all business operations effective immediately. The closure includes its affiliated entities: SolanaFloor, a media and analytics platform, and Remora Markets, a tokenized equities trading protocol. The decision directly results from a January 31 security breach that compromised the company’s treasury wallets, leading to a loss of roughly 261,854 SOL (valued between $26 million and $40 million at the time of the incident).

According to the official statement, the Step Group “explored every possible path forward, including financing and acquisition opportunities,” but was ultimately unable to secure a viable outcome, leading to the “difficult decision to end all operations”.

Anatomy of the Security Breach

The security incident, disclosed in early February, involved the compromise of devices belonging to company executives. Investigations confirmed that the attackers gained access to treasury wallets through a sophisticated social engineering and device infiltration campaign rather than exploiting a smart contract vulnerability.

Blockchain security firm CertiK initially tracked the movement of funds, identifying that the attackers unstaked and transferred a significant volume of SOL. While early estimates placed the loss at $27 million, subsequent internal audits confirmed the total value of assets stolen to be approximately $40 million. The team successfully recovered roughly $3.7 million in assets related to Remora and $1 million in other positions following coordination with security professionals and law enforcement. The incident highlights a growing trend in the crypto sector where attackers target operational security and personnel rather than protocol code.

Remediation: Buyback and Redemption Details

In its closing statement, Step Finance outlined specific measures for token holders:

• STEP Buyback: The team is working on a buyback program for STEP token holders, utilizing a snapshot of balances taken prior to the January 31 incident. This aims to compensate holders based on historical records before the treasury was drained.
• Remora Redemption: A separate redemption process is being established for holders of Remora rTokens. The team confirmed that Remora tokens remain fully backed on a 1:1 basis, allowing holders to redeem their tokens for USDC, with full details to be published shortly.

Impact on Solana Ecosystem and Market Response

The shutdown marks the dissolution of two long-standing entities within the Solana ecosystem. Step Finance, founded in 2021, served as a core utility layer by aggregating liquidity pool (LP) tokens, yield positions, and user data across roughly 95% of Solana protocols. At its peak, the platform serviced approximately 300,000 monthly users. SolanaFloor served as a prominent media outlet covering ecosystem launches and market trends.

The closure adds pressure to the Solana DeFi landscape, which has seen its total value locked (TVL) decline by approximately 52% from peaks in late 2025. In response to the shutdown announcement, the native STEP token experienced a further 36% decline, bringing its total loss to over 97% since the hack and trading at approximately $0.00057, down from a 2021 all-time high of $10.20.

Frequently Asked Questions (FAQ)

1. What caused the shutdown of Step Finance?

The shutdown was triggered by a security breach on January 31, 2026, in which hackers compromised executive devices to steal approximately $40 million from the company’s treasury. Unable to secure acquisition or financing deals to recover from the financial shortfall, the group decided to cease all operations.

2. Will STEP token holders get their money back?

The Step Finance team is implementing a buyback program based on a snapshot taken prior to the hack. Eligible STEP holders will be compensated based on their historical balances. Specific details on the timeline and mechanism are expected to be released by the team.

3. What is happening to Remora Markets and its **** rTokens**?**

Remora Markets is also ceasing operations. However, the team has stated that Remora tokens remain fully backed on a 1:1 basis. A redemption process is being prepared to allow rToken holders to redeem their tokens for USDC.