Step Finance, widely known as the "front page of Solana," has announced an immediate shutdown following a $40 million hack in late January 2026. The breach did not involve smart contract exploits—instead, attackers compromised an executive's device and siphoned approximately 261,854 SOL from treasury wallets. Despite rapid response, the funds were not recovered. After weeks of exploring fundraising, strategic financing, and merger options, the team concluded no viable path forward and chose to close all operations.
STEP Token Holders: Buyback Tied to Pre-Hack Snapshot
To mitigate losses, Step Finance confirmed it is working on a buyback program based on a blockchain snapshot taken before the attack. This mechanism aims to compensate holders fairly for the hack-induced damage. Further details are expected in the coming days.
Remora rToken Redemption: Fully Backed 1:1
For users of Remora Markets, a subsidiary of Step Finance, the outlook is partially reassuring. The team stated that rToken redemption processes are being prepared, and all rTokens remain 1:1 fully backed. Holders should be able to redeem their assets at full backing value despite the parent company's shutdown.
Market Turmoil and Solana Ecosystem Fallout
Following the announcement, the STEP token plunged over 34% in 24 hours to $0.0006013, with surging volume reflecting panic sell-offs. Analysts warn that similar operational security incidents have historically caused 80-90% token value declines for affected projects. The shutdown also reignites calls for multi-signature treasury protection, device isolation, and executive-level cybersecurity training across the Solana ecosystem.
The Step Finance collapse serves as a stark reminder: in DeFi, security extends far beyond code audits. The team promises to release more information on the buyback and Remora redemption schedules soon.