Step Finance confirmed that attackers compromised several treasury and fee wallets during Asia Pacific trading hours and stole 261,854 SOL worth about $30 million. CertiK reported that the stolen tokens were withdrawn after stake authorization shifted to an unknown wallet, raising fresh security concerns across the Solana ecosystem.
The platform disclosed the breach through urgent social media posts. It said a sophisticated actor exploited a well-known attack vector. The team activated emergency protocols and contacted cybersecurity firms for immediate support.
CertiK stated that the stolen SOL moved after stake authorization changed hands. On-chain data showed the tokens were unstaked and transferred during the incident. The activity suggested the attacker gained direct control over staking operations.
Step Finance said user funds remained unaffected. Still, observers questioned whether the breach reflected a deeper internal failure. Did the attacker gain direct wallet access rather than exploit smart contracts?
The team said it notified the relevant authorities. It also worked with security professionals around the clock to contain the damage.
Solana Floor reported that on-chain data confirmed the unstaking and movement of 261,854 SOL during the breach. The transfer pattern pointed to staking authorization control rather than a contract exploit.
Step Finance stated that several treasury and fee wallets were compromised. It described the incident as the result of a known attack vector. The company did not cite a smart contract vulnerability.
Meanwhile, SolanaFloor will stop producing new content. The media outlet had grown into a major platform covering the Solana ecosystem. Its articles and newsletters will remain online as an archive.
The parent company cited financial and operational challenges for the shutdown. The most recent wallet breach worsened its financial position. Broader market conditions compounded the strain.
Step Finance announced that it will develop a buyback plan for STEP token holders. It also plans a redemption process for Remora rToken owners. The company based both efforts on snapshots taken before the hack.
Step Finance had already announced restructuring in November 2025. It retired products such as the Step Dashboard, APIs, and its mobile app. The company cited high maintenance costs and monetization challenges.
The 2026 breach drained about $40 million from its vaults. The loss proved too large to offset through new funding or partnerships. The company explored mergers and alternative business models but found no workable solution.
As a result, SolanaFloor could not continue operations. The financial setback reshaped the company’s trajectory. The restructuring now forms part of a broader survival strategy.
CertiK described January 2026 as a severe month for crypto security. The firm reported about $370.3 million lost to exploits across multiple attack types.
Phishing accounted for $311.3 million of the total losses. Code vulnerabilities led to another $51.5 million in damages.
Major January cases included Truebit’s $26.6 million smart contract exploit. SwapNet suffered a $13.3 million breach affecting Matcha Meta users. Saga lost $6.2 million and paused its SagaEVM chain. Makina Finance recorded a $4.2 million flash loan attack.
The Step Finance breach adds to recent Solana-related incidents. SwissBorg lost $41.5 million worth of SOL in September 2025 after hackers breached API provider Kiln. Upbit lost $36 million in a Solana exploit in November 2025.
January also recorded the largest single crypto theft of 2026. A victim lost over $282 million in Bitcoin and Litecoin through a hardware wallet social engineering scam, according to blockchain investigator ZachXBT.
Also Read: Why Solana (SOL) Might be Set for a $100 Short Squeeze in 2026
Step Finance confirmed a treasury wallet breach that drained 261854 SOL worth about $30 million during Asia Pacific hours. CertiK linked the theft to a stake authorization shift and on-chain unstaking activity. The incident adds to January security losses. Traders should track official updates and review wallet access controls.