Solana-Based Step Finance Investigating $29M Treasury Wallet Hack

TLDR

• Step Finance’s treasury wallets were compromised, with $29 million worth of SOL transferred.
• The breach involved 261,854 SOL, worth approximately $29 million at current prices.
• Step Finance’s STEP token dropped over 60% after the security incident.
• No confirmation yet whether user funds were affected by the treasury wallet breach.

Step Finance, a prominent decentralized finance (DeFi) platform built on the Solana blockchain, has confirmed that some of its treasury and fee wallets were compromised in a recent security incident. The platform, which helps users manage their Solana-based portfolios, disclosed that an investigation is underway to determine the cause of the breach and its impact.

???? JUST IN: Solana DeFi platform Step Finance investigating a wallet compromise tied to $29M in SOL. pic.twitter.com/ETyJAeX4w2

— The Daily Block (@thedailyblock) February 1, 2026

Blockchain data revealed that around 261,854 SOL tokens, valued at about $29 million, were unstaked and transferred during the attack. The incident comes amid growing concerns over security in the Solana ecosystem, which has experienced several breaches over the past few years.

Breach Details and Investigation

Step Finance announced the breach via its official social media channels, stating that a security incident involving the treasury wallets occurred hours prior to the disclosure. “There has been a breach of security for some of our treasury wallets, and we are currently investigating the issue,” the platform wrote on X (formerly Twitter). They further assured users that more information would be released as the investigation progresses.

Cybersecurity firms have been engaged to assist with the ongoing investigation, though the platform has not yet clarified the cause of the breach. It remains unclear whether the attack originated from a vulnerability in a smart contract, an access control issue, or a different factor. Step Finance has not yet revealed whether the compromised wallets contained user funds, but the investigation is expected to clarify this.

Financial Impact of the Incident

The compromise of Step Finance’s treasury wallets has had a notable effect on the platform’s native token, STEP. After the news broke, STEP’s price plunged by over 60%. As of now, STEP is trading at approximately $0.023, reflecting the market’s negative response to the security breach.

Step Finance operates a validator node and utilizes its validator revenue to buy back STEP tokens, which are then distributed to users who stake xSTEP tokens. The loss of $29 million in SOL from the treasury could also affect these buyback operations, further impacting the platform’s tokenomics and user sentiment.

Broader Context of Solana Ecosystem Security

This breach adds to a growing list of security incidents affecting the Solana blockchain. The network has seen multiple high-profile attacks over the past few years. For instance, the Loopscale lending protocol lost $5.8 million in an exploit, and the decentralized credit protocol CrediX experienced a $4.5 million breach. In November 2025, the South Korean exchange Upbit suffered a $37 million hack that affected Solana-based assets.

Despite these challenges, Solana’s DeFi ecosystem continues to grow, with many projects, including Step Finance, contributing to its development. However, the latest breach underscores the need for improved security measures across all platforms within the ecosystem.