Step Finance Treasury Wallet Theft via Compromised Executive Devices

Step Finance, a Solana-based DeFi platform and analytics dashboard, reported a breach in which attackers compromised devices belonging to company executives and used that access to drain multiple treasury wallets. The incident was detected on January 31, with the threat actor described as leveraging a “well-known attack vector,” though Step Finance did not publicly disclose the specific technique or attribution.

Initial third-party estimates from blockchain analytics firm CertiK put the theft at 261,854 SOL (~$28.9M), but Step Finance’s internal investigation later assessed total losses at ~$40M. Step Finance said it has recovered ~$3.7M in Remora assets and ~$1M in other positions through partner coordination and Token22 protections, temporarily halted some operations to reinforce security, and stated that Remora Markets is isolated from the incident with rTokens remaining 1:1 backed; users were also advised not to engage with the STEP token until the investigation concludes.