Step Finance, a prominent decentralized finance platform active on the Solana blockchain since 2021, has announced a complete shutdown of its operations following a major security breach at the end of January 2026. The company stated that the incident, which involved the theft of $27 million, not only affects its own activities but also those of the ecosystem news platform SolanaFloor and real-world asset trading platform Remora Markets, both of which now face closure.
Security Breach Details and Fallout
On January 31, 2026, Step Finance detected what it described as a sophisticated cyberattack targeting several treasury and fee wallets. According to an internal investigation, attackers gained access to administrative devices, enabling them to withdraw roughly 261,000 SOL tokens from staking and transfer them to unfamiliar addresses. The immediate aftermath saw a severe blow to the protocol’s liquidity and reserves as the extent of the heist became clear.
“Several of our treasury wallets were compromised a few hours ago; our investigation into the incident is ongoing,” Step Finance stated as the situation unfolded.
The breach had an immediate impact on the STEP token, whose price plummeted by over 37% in the hours after the news broke, and has since collapsed by a total of 97% from its peak. In response to mounting losses, the team announced plans to initiate a buyback scheme anchored to token values prior to the attack, aiming to soften the blow for users. Additionally, rToken holders associated with Remora Markets will be able to redeem their assets at a 1:1 ratio, providing a degree of compensation.
Corporate Closure and Response Efforts
Following the January attack, Step Finance’s leadership explored various avenues to salvage the company, including seeking acquisition offers and bridge financing. However, a statement issued on February 23, 2026, confirmed that none of these strategies yielded a viable path forward, prompting the decision to cease operations entirely.
“It has been decided to shut down all operations of Step Finance, SolanaFloor, and Remora Markets. After exhausting all options—including funding and acquisition—following January’s attack, we unfortunately could not find a sustainable way to move ahead,” the team relayed through a company update.
By February, all three entities—Step Finance, SolanaFloor, and Remora Markets—will have fully wound down their services. SolanaFloor’s content archive will remain accessible for the time being, at least preserving the informational foundation built over the years.
Broader Impact and Ecosystem Developments
The closure comes on the heels of a period of rapid growth for Step Finance, especially toward the end of 2025, when it pivoted its focus to larger-scale “mega products.” This shift involved winding down its flagship dashboard and API services to dedicate resources to SolanaFloor and Remora Markets. Notably, Remora had recently attracted attention by reaching $110 million in trading volume via tokenized versions of Nvidia and Tesla shares.
The incident underscores ongoing vulnerabilities in DeFi treasury management, showing that even long-established projects remain susceptible to large-scale attacks. It serves as a stark reminder that comprehensive security frameworks are still lacking in some corners of the industry.
Meanwhile, the decentralized SocialFi platform Zora has introduced a new “attention market” product on Solana, enabling users to trade on trending online topics. To prevent manipulation, starting a new Trend is priced at 1 SOL. Unlike conventional token markets, these Trends do not offer rewards; instead, users participate by creating and trading “Pairs” within the system, reflecting a novel approach to digital engagement.
