Solana DeFi platform Step Finance investigating $29 million treasury wallet compromise

Step Finance, a Solana ecosystem DeFi platform that calls itself "the front page of Solana," disclosed that some of its treasury and fee wallets were compromised and are currently under investigation, according to an announcement from the project.

Onchain data reveals that approximately 261,854 SOL was unstaked and transferred during the incident. At SOL's current price of around $110, the transfers represent roughly $29 million in value, per blockchain security firm CertiK. 

"There has been a breach of security for some of our treasury wallets hours ago and we are currently investigating...More information will be posted at a later stage," Step Finance wrote on X. The platform also asked cybersecurity firms to assist with the investigation. 

Step Finance has not disclosed the root cause of the compromise, whether it resulted from a smart contract vulnerability or access control issue, or whether any user funds beyond the protocol treasury were affected. The project did not immediately respond to a request for comment from The Block.

Founded in 2021, Step Finance describes itself as a portfolio visualization platform that aggregates LP tokens, yield farms, and positions across approximately 95% of Solana protocols into a single dashboard. The platform also operates SolanaFloor, a Solana-focused news outlet, and puts on the annual Solana Crossroads conference in Istanbul. In Dec. 2024, the project acquired early-stage startup Moose Capital, since rebranded to Remora Markets, in a bid to bring tokenized trading of major stocks like Nvidia and Tesla to Solana. 

The STEP token, which powers governance and staking rewards for the protocol, is trading at approximately $0.023, after dropping more than 60% over the past 24 hours, according to CoinGecko data. Step Finance operates a validator node and directs 100% of validator revenue after operating costs toward STEP buybacks, which are distributed to xSTEP stakers.

The incident adds to a series of exploits and compromises affecting Solana ecosystem projects. In April 2025, lending protocol Loopscale lost $5.8 million to an exploit two weeks after launch, while decentralized credit protocol CrediX suffered a $4.5 million breach in August 2025 after an attacker gained control of an administrator wallet. In November 2025, South Korean exchange Upbit experienced a $37 million hack affecting various Solana network assets.

Blockchain analytics firm Chainalysis reported in December 2025 that cryptocurrency theft totaled over $3.41 billion for the year, with DeFi hack losses remaining suppressed even as total value locked rebounded across the sector.

This is a developing story.