Step Finance is shutting down its operations, with its core platform, SolanaFloor, and Remora Markets going offline effective immediately. In a statement posted on Feb. 24, the company said a late-January security breach severely damaged its financial position, and efforts to raise capital or find an acquirer did not produce a sustainable outcome.
The breach took place on Jan. 31, 2026. According to the company, attackers compromised devices used by members of the executive team, then gained access to treasury and fee wallets and moved large amounts of digital assets. Investigators later said the platform’s smart contracts were not exploited. The failure came from compromised endpoints and weak device security controls.
The breach came through executive devices, not smart contracts
Step Finance said roughly 261,854 SOL was unstaked and moved during the attack, worth about $27 million to $30 million at the time. Later assessments put total losses across multiple assets at nearly $40 million. Working with partners and using Solana’s Token22 protections, the team recovered about $4.7 million, but that amount was not enough to stabilize the business.
The financial hit was followed by a collapse in market confidence. The report said the platform’s native STEP token fell by more than 97%, erasing much of its market value and making fundraising harder. In its statement, the company said it had explored every possible path forward but could not secure a durable result.
Buybacks and redemptions are being prepared
As part of the shutdown, Step Finance said it is preparing a buyback program for STEP holders. The buyback will be based on a snapshot taken before the January breach, though full terms have not been released. Remora Markets also issued a separate statement saying all rTokens remain fully backed on a 1:1 basis, and a redemption process is being prepared so holders can exchange them for USDC.
The closure affects several products used across the Solana ecosystem, including portfolio tracking tools, market data services, and tokenized equity offerings. Company leadership thanked users for their support and said shutting down was the most responsible decision given the financial pressure and operational damage.
A platform failure driven by off-chain security weakness
The case is being described as one of the larger platform-level failures seen in early 2026. It also highlights a recurring issue in crypto operations: damage does not need to begin in a smart contract to be severe. Weaknesses in private key handling, internal controls, and bring-your-own-device practices can be enough to bring down established platforms.