NewsCompaniesFlawsGuides
Get the app
HighClosedUpdated

Step Finance loses about US$40 million after executive device compromise; shuts down and pays eligible claims

Compromised executive devices led to about US$40 million being stolen from Step Finance's treasury. The business shut down; eligible token-holder claims were paid by April. Claims are closed. Keep payout records and beware unsolicited recovery offers.

What to do

There is no software update for this treasury theft. If your family held STEP or xSTEP, retain your claim and payment records; the claim programme has ended. Treat new refund links and requests for your wallet recovery phrase as suspicious.

What’s happening

Step Finance, a Solana cryptocurrency portfolio service, said attackers compromised executive devices and stole approximately US$40 million from its treasury on 31 January 2026. Initial blockchain reporting identified 261,854 SOL transferred from treasury wallets; CoinDesk valued that portion at about US$27 million, before the company's larger total emerged. Step reported recovering roughly US$4.7 million in assets. The company attributed the theft to device compromise, rather than a smart contract flaw requiring a customer software update; the precise device compromise method remains unconfirmed in the reviewed sources. After rescue financing and acquisition efforts failed, Step announced its shutdown on 23 February. A later buyback covered eligible STEP and xSTEP holdings recorded before the theft. On 29 April, Step said all eligible submitted claims had been paid and the process had ended. As of 3 November, the reviewed sources do not confirm full recovery of the treasury loss or that holders were compensated in full.

What
Breach
Affects
Step Finance treasury and fee wallets; STEP and xSTEP token holders
Fixed in
Nothing to patch
Since
31 Jan 2026
Closed
29 Apr 2026

Timeline

  1. Update

    Step Finance said the claims process had finished and payments had been sent for all eligible submitted claims. Its statement did not establish full recovery of the stolen treasury funds.

  2. Update

    The token-holder claim window closed, according to Solana Compass.

  3. Update

    Step opened claims for people who held STEP or xSTEP in wallets at the 30 January snapshot, according to Solana Compass.

  4. Update

    Step Finance announced an immediate shutdown after financing and acquisition efforts failed, including plans to close SolanaFloor and Remora Markets. It proposed a STEP buyback and a separate Remora token redemption process.

  5. Update

    Step Finance put the total theft at approximately US$40 million and attributed it to compromised executive devices. It reported recovering about US$3.7 million in Remora assets and US$1 million in other positions.

  6. Made publicNothing to patch

    Step Finance disclosed compromised treasury wallets. CoinDesk reported CertiK's finding that 261,854 SOL had been unstaked and transferred, initially valued at about US$27 million.

Sources

  1. Claims concluded and eligible claims paid — Step Finance statement, reproduced by InstalkerStep Finance (via Instalker) · 29 Apr 2026
  2. Solana DeFi platform step finance hit by $27 million treasury hack as token price cratersCoinDesk · 31 Jan 2026
  3. $40 million worth of crypto stolen from Step Finance — hackers compromise executives’ devices to gain illicit accessTom's Hardware · 5 Feb 2026
  4. Crypto platform Step Finance shutting down after $40 million theftThe Record · 24 Feb 2026
  5. Step Finance — project history and wind-down chronologySolana Compass
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from January 2026 · JSON · RSS