How a Wallet Compromise Killed the Solana DeFi Aggregator

After exploring fundraising and acquisition choices, the groups concluded that no sustainable restoration path existed following the breach.

Solana-based DeFi aggregator, Step Finance, together with two different affiliate initiatives, SolanaFloor and Remora Markets, introduced plans to close down all operations with fast impact.

The choice follows the aftermath of a significant safety incident earlier this 12 months.

Hack, Halt, Shutdown

In an announcement shared on X, the groups said the choice got here after exploring a number of paths ahead, together with fundraising and acquisition discussions. Nonetheless, none resulted in a viable resolution after the hack that occurred in late January.

The incident concerned an estimated $30 million in belongings being drained from Step Finance’s wallets on the Solana community. Subsequent disclosures indicated that the breach stemmed from compromised gadgets belonging to members of the venture’s government workforce.

Entry to those gadgets probably uncovered personal keys or enabled malware that interfered with inside transaction approval processes, which allowed attackers to provoke and approve malicious on-chain transactions. As soon as entry was obtained, the attackers unstaked roughly 261,854 SOL and transferred the funds out of project-controlled wallets. This triggered an instantaneous market response that noticed the STEP token fall by greater than 80%.

Following detection of the exploit, the workforce halted sure parts of the platform to restrict additional harm and later reported that roughly $4.7 million in Remora-related belongings and different holdings have been recovered. As a part of the shutdown course of, Step Finance mentioned it’s engaged on a buyback program for STEP token holders primarily based on a snapshot taken previous to the incident, whereas Remora Markets is making ready a redemption course of for rToken holders.

Over 200 Hack Incidents in 2025

The hack involving Step Finance ranked among the many costliest DeFi incidents in January 2026, amidst a broader rise in crypto-related losses over the previous 12 months. In response to information from blockchain safety agency PeckShield, scams and hacks drained greater than $4.04 billion from customers and platforms in 2025, which is a rise of just about 34% in comparison with 2024.

You may additionally like:

Of that complete, $2.67 billion was attributed to hacks, whereas $1.37 billion originated from scams, as scam-related losses rose about 64% year-on-year.

PeckShield discovered a pivot from purely technical exploits towards focused social engineering, usually geared toward centralized entities and high-value people, thereby leading to larger losses per incident. Greater than 200 hack circumstances have been recorded through the 12 months, excluding scams.

February stood out as the most expensive month, pushed by a $1.51 billion breach at Bybit.