{"id":"step-finance-treasury-theft-jan-2026","category":"breach","status":"closed","title":"Step Finance loses about US$40 million after executive device compromise; shuts down and pays eligible claims","tldr":"Compromised executive devices led to about US$40 million being stolen from Step Finance's treasury. The business shut down; eligible token-holder claims were paid by April. Claims are closed. Keep payout records and beware unsolicited recovery offers.","summary":"Step Finance, a Solana cryptocurrency portfolio service, said attackers compromised executive devices and stole approximately US$40 million from its treasury on 31 January 2026. Initial blockchain reporting identified 261,854 SOL transferred from treasury wallets; CoinDesk valued that portion at about US$27 million, before the company's larger total emerged. Step reported recovering roughly US$4.7 million in assets. The company attributed the theft to device compromise, rather than a smart contract flaw requiring a customer software update; the precise device compromise method remains unconfirmed in the reviewed sources. After rescue financing and acquisition efforts failed, Step announced its shutdown on 23 February. A later buyback covered eligible STEP and xSTEP holdings recorded before the theft. On 29 April, Step said all eligible submitted claims had been paid and the process had ended. As of 3 November, the reviewed sources do not confirm full recovery of the treasury loss or that holders were compensated in full.","action":"There is no software update for this treasury theft. If your family held STEP or xSTEP, retain your claim and payment records; the claim programme has ended. Treat new refund links and requests for your wallet recovery phrase as suspicious.","product":"Step Finance treasury and fee wallets; STEP and xSTEP token holders","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["step-finance","solana","crypto","crypto-theft","device-compromise"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"post","title":"Claims concluded and eligible claims paid — Step Finance statement, reproduced by Instalker","url":"https://www.instalker.org/StepFinance_/status/2049579285732532235","by":"Step Finance (via Instalker)","date":"2026-04-29"},{"kind":"news","title":"Solana DeFi platform step finance hit by $27 million treasury hack as token price craters","url":"https://www.coindesk.com/business/2026/01/31/solana-based-defi-platform-step-finance-hit-by-usd30-million-treasury-hack-as-token-price-craters","by":"CoinDesk","date":"2026-01-31"},{"kind":"news","title":"$40 million worth of crypto stolen from Step Finance — hackers compromise executives’ devices to gain illicit access","url":"https://www.tomshardware.com/tech-industry/cyber-security/usd40-million-worth-of-crypto-stolen-from-step-finance-hackers-compromise-executives-devices-to-gain-illicit-access","by":"Tom's Hardware","date":"2026-02-05"},{"kind":"news","title":"Crypto platform Step Finance shutting down after $40 million theft","url":"https://therecord.media/step-finance-cryptocurrency-theft-shutdown","by":"The Record","date":"2026-02-24"},{"kind":"research","title":"Step Finance — project history and wind-down chronology","url":"https://solanacompass.com/projects/step-finance","by":"Solana Compass","date":""}],"started":"2026-01-31","closed":"2026-04-29","created":"2026-11-03T21:34:01.451Z","updated":"2026-11-03T21:34:01.451Z","cve_notes":[],"timeline":[{"at":"2026-04-29","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Step Finance said the claims process had finished and payments had been sent for all eligible submitted claims. Its statement did not establish full recovery of the stolen treasury funds.","url":"https://www.instalker.org/StepFinance_/status/2049579285732532235","by":"Step Finance (X statement reproduced by Instalker)","patch":null},{"at":"2026-04-25","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"The token-holder claim window closed, according to Solana Compass.","url":"https://solanacompass.com/projects/step-finance","by":"Solana Compass","patch":null},{"at":"2026-03-26","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Step opened claims for people who held STEP or xSTEP in wallets at the 30 January snapshot, according to Solana Compass.","url":"https://solanacompass.com/projects/step-finance","by":"Solana Compass","patch":null},{"at":"2026-02-23","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Step Finance announced an immediate shutdown after financing and acquisition efforts failed, including plans to close SolanaFloor and Remora Markets. It proposed a STEP buyback and a separate Remora token redemption process.","url":"https://therecord.media/step-finance-cryptocurrency-theft-shutdown","by":"The Record","patch":null},{"at":"2026-02-02","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Step Finance put the total theft at approximately US$40 million and attributed it to compromised executive devices. It reported recovering about US$3.7 million in Remora assets and US$1 million in other positions.","url":"https://www.tomshardware.com/tech-industry/cyber-security/usd40-million-worth-of-crypto-stolen-from-step-finance-hackers-compromise-executives-devices-to-gain-illicit-access","by":"Tom's Hardware","patch":null},{"at":"2026-01-31","added":"2026-11-03T21:25:43.261Z","kind":"disclosed","text":"Step Finance disclosed compromised treasury wallets. CoinDesk reported CertiK's finding that 261,854 SOL had been unstaked and transferred, initially valued at about US$27 million.","url":"https://www.coindesk.com/business/2026/01/31/solana-based-defi-platform-step-finance-hit-by-usd30-million-treasury-hack-as-token-price-craters","by":"CoinDesk","patch":"na"}],"url":"https://hard.fyi/live/step-finance-treasury-theft-jan-2026/","json":"https://hard.fyi/api/live?id=step-finance-treasury-theft-jan-2026"}