šØ Step Finance treasury breach drains $27M in SOL; STEP token crashes 90% as attacker unstakes and transfers protocol-owned funds šØ
Solana-based DeFi portfolio tracker Step Finance disclosed a treasury wallet breach that saw approximately 261,854 SOL (worth around $27.2 million) unstaked and transferred by a sophisticated attacker during APAC hours, triggering a 93.3% collapse in the project's STEP governance token. The platform confirmed multiple treasury wallets were compromised through "a well known attack vector" but did not specify whether the breach stemmed from a smart contract flaw, compromised private keys, or internal access issues. Onchain data reviewed by CertiK shows the attacker systematically unstaked and moved protocol-owned SOL, though it remains unclear whether any user funds beyond treasury assets were affected. Market reaction was swift and severe, with STEP trading at $0.001578 at time of writing, down from prior levels as confidence evaporated.
š Key points
š¹ Treasury drainage: Blockchain security firm CertiK identified approximately 261,854 SOL (worth around $27.2 million) unstaked and transferred from Step Finance-controlled wallets; the attacker moved protocol-owned treasury assets onchain in a coordinated series of transactions during Asian-Pacific hours.
š¹ Attack vector undisclosed: Step Finance stated the breach was facilitated through "a well known attack vector" but did not reveal whether the compromise involved a smart contract vulnerability, stolen private keys, social engineering, or an internal access breach; the platform said it has taken "remediation" steps without elaborating.
š¹ Token collapse: STEP governance token plunged 93.3% over 24 hours to $0.001578 as of time of writing, reflecting total loss of market confidence; CoinGecko data shows the token dropped more than 90% immediately following disclosure of the treasury breach.
š¹ User fund uncertainty: Step Finance has not confirmed the total scale of losses or clarified whether any user-deposited funds were affected beyond protocol-owned treasury assets; the lack of transparency has compounded market panic and undermined recovery prospects.
š¹ Step Finance ecosystem: Founded in 2021, Step Finance positions itself as the "front page of Solana," offering a unified dashboard to track yield farms, LP tokens, and DeFi positions across Solana protocols; the company also operates SolanaFloor media outlet, organizes the annual Solana Crossroads conference, and acquired Moose Capital (rebranded Remora Markets) in late 2024 to introduce tokenized equity trading on Solana.
š Why it matters
š¹ Recovery unlikely: Nearly 80% of crypto projects that suffer a major hack fail to fully recover, not due to financial loss but because of poor crisis response and trust collapse; Immunefi CEO Mitchell Amador notes most teams are unprepared for security incidents, leading to hesitation, slow decision-making, and weak communication in critical post-breach hours.
š¹ Treasury security gap: The breach underscores persistent vulnerabilities in DeFi treasury management, particularly multisig wallet configurations and private key custody; despite years of high-profile exploits, many protocols still fail to implement hardware security modules, time-locks, or social recovery mechanisms that could limit damage from compromised credentials.
š¹ Governance token death spiral: STEP's 93.3% collapse illustrates how governance tokens are uniquely vulnerable to treasury breaches; unlike user funds that can be made whole through insurance or protocol bailouts, governance tokens have no recovery mechanism and become worthless if the underlying protocol treasury is drained and trust evaporates.
š¹ Solana ecosystem exposure: Step Finance's role as a central aggregator and conference organizer means the breach damages broader Solana ecosystem credibility; the loss of a major DeFi dashboard and the collapse of tokenized equity ambitions at Remora Markets remove key infrastructure and innovation vectors from the Solana stack.
šÆ Bottom line: Step Finance's $27 million treasury breach and STEP's 90%+ collapse follow a familiar patternācrypto projects that suffer major hacks rarely recover because they bungle the crisis response and shatter user trust. By failing to disclose the attack vector, confirm total losses, or clarify whether user funds are at risk, Step Finance has compounded the damage and likely sealed its fate. The breach highlights that even well-established DeFi protocols remain vulnerable to basic security failures, and governance tokens offer no recovery mechanism when treasury assets are drained. Unless Step Finance delivers immediate transparency and a credible recovery plan, it joins the 80% of hacked projects that never bounce back.
https://cointelegraph.com/news/step-finance-treasury-breach-solana-step-token-crash