Step Finance winds down after treasury breach that moved 261,854 SOL

Step Finance announced it will wind down all operations after a security incident that led to the unstaking and transfer of 261,854 SOL from its treasury and operational wallets, an on‑chain analytics firm tallied. The company said it explored financing and acquisition options but “was unable to secure a viable outcome” and moved to end Step Finance, SolanaFloor and Remora Markets effective immediately.

Step detected the compromise in late January and said in an initial statement that “Earlier today, several of our treasury wallets were compromised by a sophisticated actor during APAC hours.” On‑chain analytics firm CertiK reported the attacker unstaked and transferred 261,854 SOL; that quantity has been valued in published accounts at roughly $27 million to $30 million depending on the market snapshot used. Step said during its investigation that losses were approximately $40 million, a higher internal estimate that the company attributed to its review of affected assets.

Step said executives engaged cybersecurity researchers, notified authorities and sought partner assistance to recover assets. Token22 protections and partner coordination have been credited with returning some positions, including about $3.7 million in Remora assets and roughly $1 million in other holdings, according to the company’s account of remediation efforts. Step also said that Remora rTokens remain backed 1:1 and that it is developing a redemption process for affected Remora holders.

In a separate announcement outlining the decision to wind down, Step wrote: “Following the hack at the end of January we explored every possible path forward, including financing and acquisition opportunities. Unfortunately, we were unable to secure a viable outcome and have made the difficult decision to end all operations effective immediately.” The company said it will execute a STEP token buyback for eligible holders using a snapshot taken prior to the incident.

The incident triggered a sharp market reaction for the project’s governance token. Data cited by market trackers showed STEP fell more than 80 percent in a 24‑hour span. Step historically funded buybacks in part with earnings from a Solana validator node it operated, a mechanism that the company had retained after a restructuring late last year.

Step’s move to wind down comes after a period of internal change. Founded in 2021 as a Solana dashboard that aggregated yield farms and DeFi positions, Step restructured “last November,” retiring its dashboard, APIs and mobile app to concentrate on media and trading initiatives under the SolanaFloor and Remora brands. The firm acquired Moose Capital, now Remora Markets, in late 2024 as it pushed into tokenized equity trading on Solana.

SolanaFloor, the project’s media arm, said in a farewell message that “What began as a small X account grew into one of the most widely read” outlets for Solana coverage and that it will cease producing new articles, videos and newsletters while keeping its archive accessible.

The episode underscores persistent risks for projects that hold sizable treasuries on chain and for teams that manage operational keys and devices. Step urged anyone with information or resources to assist to come forward as investigations continue and as the company works to complete buybacks and redemptions for token holders.