Solana-based DeFi aggregator Step Finance has announced it will immediately cease all operations following a major security breach in late January.
After several weeks of exploring financing and acquisition options, the team confirmed it was unable to secure a sustainable recovery plan.
Scope of the Shutdown
The shutdown affects all projects operating under the Step Finance umbrella.
Today we are announcing that Step Finance, SolanaFloor, and Remora Markets will be winding down all operations.
Following the hack at the end of January we explored every possible path forward, including financing and acquisition opportunities.
Unfortunately, we were unable to…
— Step☀️ (@StepFinance_) February 23, 2026
This includes the Step Finance Dashboard, the platform’s core portfolio management and analytics tool widely used across the Solana ecosystem. It also includes SolanaFloor, a prominent Solana-focused media and NFT analytics platform, as well as Remora Markets, a tokenized equities trading platform that Step acquired in 2024.
The closure marks one of the most significant operational collapses within Solana’s DeFi landscape this year.
The $40 Million Security Breach
The crisis stems from a January 31, 2026 security incident.
Investigators concluded the breach was operational rather than structural. Instead of exploiting smart contract vulnerabilities, attackers reportedly compromised personal devices belonging to executive team members. This allowed access to critical authentication credentials, which were then used to drain treasury and fee wallets.
Initial reports estimated losses at $29 million (around 261,854 SOL), but subsequent assessments confirmed total losses across assets reached nearly $40 million.
Through coordination with ecosystem partners and leveraging Solana’s Token22 protections, approximately $4.7 million was recovered. However, this was not enough to restore financial stability.
Impact on STEP Token and Users
The fallout was immediate.
The native STEP governance token collapsed more than 97% after the hack and was trading near $0.00058 at the time of the shutdown announcement.
To mitigate damage, the team is preparing a buyback program for STEP holders based on a snapshot taken prior to the January 31 breach.
Meanwhile, Remora Markets confirmed its rTokens remain fully backed on a 1:1 basis. A redemption process is being established to allow users to exchange those tokens for USDC.
Bigger Picture
The incident highlights the growing importance of operational security in crypto. While smart contract audits often receive the spotlight, this breach underscores how executive-level device compromises can pose equally devastating risks.
For Solana’s DeFi ecosystem, the shutdown of Step Finance represents both a financial loss and a reputational setback, reinforcing the need for stronger security standards beyond just on-chain code.
