Step Finance Treasury Drained of $30M; STEP Crashes to All-Time Low
Attackers unstaked and transferred 261,854 SOL from Step Finance’s treasury, sending the STEP token plummeting 80% to new lows.
Solana analytics protocol Step Finance confirmed a critical security breach Saturday, resulting in the theft of approximately $30 million in treasury assets. The exploit targeted the platform’s fee and treasury wallets, forcing the native token (STEP) to a new all-time low of $0.0059.
The Exploit
Attackers gained access to Step Finance’s core treasury wallets early Jan. 31, unstaking and transferring roughly 261,854 SOL in a single sweep. On-chain data corroborates the outflow, which bypassed the protocol’s standard withdrawal delays. The funds were immediately moved to an unknown address, currently labeled by explorers as the exploiter.
The team acknowledged the incident via X (formerly Twitter):
“There has been a breach of security for some of our treasury wallets hours ago and we are currently investigating. More information will be posted at a later stage.”
While Step Finance serves over 350,000 monthly users with portfolio tracking and yield aggregation, the breach appears limited to protocol-owned liquidity. No evidence currently suggests user deposits in connected smart contracts were touched.
Market Impact
Liquidity for the STEP token evaporated instantly. The asset plummeted over 80% following the disclosure, breaking its previous support levels to trade under one cent. Market makers pulled bids across Raydium and Orca, exacerbating the volatility.
This incident marks the largest treasury compromise on Solana in 2026. The team has engaged external security firms to trace the funds, though no recovery timeline exists.
