Step Finance is closing its Solana-based operations after a January cyberattack drained up to $40 million from its treasury and fee wallets.
The company confirmed in a post on X that it is shutting down its core platform, along with SolanaFloor and Remora Markets, with immediate effect.
The decision comes weeks after a security breach on Jan. 31, 2026, that severely damaged its financial position and disrupted ongoing product development plans.
Despite attempts to raise fresh capital or find a buyer, the team said it could not secure a sustainable solution.
In its X post, Step Finance thanked users for their support and described the shutdown as the most responsible step given the financial strain and operational damage. https://twitter.com/StepFinance_/status/2025986934112145849?s=20
January breach details
The attack targeted devices used by members of the executive team.
Once those endpoints were compromised, attackers gained access to treasury and fee wallets and were able to unstake and transfer large amounts of digital assets.
Around 261,854 SOL was moved during the incident.
At the time, the tokens were valued between $27 million and $30 million. Later assessments placed total losses across assets at nearly $40 million.
Investigators clarified that the platform’s smart contract infrastructure was not breached.
Instead, the vulnerability stemmed from compromised devices and insufficient endpoint security.
Working with partners and using Solana’s Token22 protections, the team managed to recover about $4.7 million.
The recovered funds were not enough to offset the scale of the losses.
Token crash and funding pressure
The fallout from the breach quickly spread to markets.
The platform’s native STEP token fell by more than 97%, erasing most of its market capitalisation within days.
The price collapse made it harder to pursue external funding or strategic alternatives.
According to the Feb. 24 X statement, the team explored all possible options, including fundraising and acquisition talks, but no viable path emerged.
The shutdown affects the core Step Finance dashboard as well as SolanaFloor and Remora Markets, which provided portfolio tracking, market data services, and tokenised equity products within the Solana ecosystem.
Buybacks and redemptions
As part of the wind-down process, Step Finance said it is preparing a buyback programme for STEP holders.
The initiative will be based on a snapshot taken before the January hack.
Further details are expected, but no timeline has been disclosed.
Remora Markets issued a separate update confirming that all rTokens remain fully backed on a one-to-one basis.
A redemption process is being developed to allow holders to exchange rTokens for USD Coin (USDC).
The company said more information about redemptions will be shared in the coming weeks.
The closure marks one of the largest platform-level failures in early 2026.
While the blockchain itself was not compromised, the episode highlights how internal controls and device security can create systemic risk when they fail.
