- Step Finance confirmed a breach involving treasury and fee wallets, with about $29M in SOL moved
- The incident triggered a sharp selloff in STEP, sending the token down over 60%
- The breach adds to ongoing security concerns across Solana’s growing DeFi ecosystem
Step Finance, a well-known DeFi platform built on Solana, has confirmed that several of its treasury and fee wallets were compromised in a recent security incident. The platform, which many users rely on to track and manage Solana-based portfolios, said an active investigation is underway to understand exactly what happened and how far the damage goes.
On-chain data shows that roughly 261,854 SOL, valued at around $29 million at the time, were unstaked and moved during the incident. The timing has raised fresh concerns about security across the Solana ecosystem, which has dealt with a series of breaches over the past few years.
What We Know About the Breach So Far
Step Finance disclosed the issue through its official social channels, noting that the breach occurred hours before the public announcement. In its statement, the team said some treasury wallets were affected and that the situation was still being assessed. More details, they added, would be shared as the investigation progresses.
Cybersecurity firms have been brought in to assist, though the root cause hasn’t been confirmed yet. It’s still unclear whether the exploit stemmed from a smart contract flaw, compromised access controls, or another vector entirely. Step Finance has also not yet clarified whether any user funds were directly impacted, something the ongoing review is expected to determine.
For now, the picture remains incomplete, and that uncertainty has weighed heavily on market sentiment.
Token Price Takes a Hit
The financial fallout was immediate. After news of the breach spread, Step Finance’s native token, STEP, dropped sharply, falling more than 60% in a short window. At last check, STEP was trading around $0.023, reflecting how quickly confidence can evaporate when security questions surface.
Step Finance runs a validator node and uses validator revenue to buy back STEP tokens, which are then distributed to users who stake xSTEP. The loss of roughly $29 million in SOL from treasury wallets could disrupt those buyback mechanics, at least in the near term, adding another layer of pressure to the token’s outlook.
Part of a Larger Security Pattern on Solana
Unfortunately, this incident isn’t happening in isolation. Solana’s ecosystem has seen several notable security breaches in recent years. The Loopscale lending protocol lost about $5.8 million in an exploit, while decentralized credit platform CrediX suffered a $4.5 million breach. In November 2025, South Korean exchange Upbit was hit by a $37 million hack tied to Solana-based assets.
Despite that history, Solana’s DeFi ecosystem continues to expand, with platforms like Step Finance playing a meaningful role in its growth. Still, the latest breach serves as another reminder that infrastructure and security need to keep pace with adoption. As investigations continue, both users and developers will be watching closely to see what lessons, if any, come out of this incident.
