Key Takeaways
- Step Finance, a prominent Solana DeFi aggregator, is permanently closing following a $26-27M security breach in January 2026
- The shutdown includes three projects: Step Finance, SolanaFloor, and Remora Markets
- STEP token value has plummeted 96% following the security incident and currently trades at $0.00057
- Token buyback program for STEP holders and redemption process for Remora rToken holders are being implemented
- Solana’s DeFi ecosystem has seen total value locked decline 52% from September highs to $6.3 billion
Once hailed as the “front page of Solana,” Step Finance is permanently closing its doors after cybercriminals stole approximately $27 million from its treasury in January 2026.
The shutdown encompasses three distinct projects: the Step Finance dashboard, NFT-focused media platform SolanaFloor, and the Remora Markets trading service. The team made the announcement public on February 23 through their X account.
On January 31, a “sophisticated actor” successfully breached multiple treasury and fee wallets. Blockchain security company CertiK verified that attackers unstaked and siphoned off 261,854 SOL tokens during the attack.
Step Finance reported contacting leading security experts and informing appropriate authorities immediately following the discovery. Cryptocurrency investor Mike Dudas revealed he was approached regarding participation in a bridge financing round but requested a comprehensive security analysis that was never delivered.
Following weeks of evaluation, the team stated they examined “every possible path forward, including financing and acquisition opportunities” after the security breach. Unable to identify a sustainable solution, they opted to cease all operations without delay.
The Platform’s Background
Launched in 2021, Step Finance served as a comprehensive aggregator for liquidity pool tokens, yield farming opportunities, and user holdings across approximately 95% of Solana-based protocols within a unified interface. During its prime, the platform attracted roughly 300,000 monthly active users.
Even before the hack occurred, the platform was undergoing significant changes. In November 2025, Step discontinued its primary dashboard to concentrate resources on SolanaFloor and Remora Markets.
Remora Markets emerged from a December 2024 acquisition of Moose Capital, a startup focused on innovation. The platform’s mission was introducing tokenized stock trading to the Solana ecosystem, featuring assets like Nvidia and Tesla.
The January security breach terminated these initiatives before they could achieve full operational status.
Impact on Token Holders
Step Finance announced plans for a buyback program targeting STEP token holders, calculated using a pre-hack snapshot. Additionally, Remora rToken holders will gain access to a redemption mechanism. The team emphasized that Remora tokens maintain their 1:1 backing.
The STEP token suffered a catastrophic 96% value loss in the immediate aftermath of the hack. Following Monday’s shutdown announcement, the token declined an additional 36%. Currently trading at $0.00057, this represents a dramatic fall from its August 2021 peak of $10.20.
SOL has experienced significant depreciation as well. At the time of the announcement, SOL traded around $78, representing a 74% decrease from its January 2025 all-time high of $293.
Solana’s aggregate DeFi total value locked has contracted 52% since reaching its September 2025 peak. Current figures show $6.3 billion, based on DeFiLlama data.
Step Finance co-founder George Harrap noted that several parties have expressed interest in acquiring components of the business, and the team remains open to pursuing legitimate opportunities.
The company concluded their announcement by expressing gratitude to their millions of users and characterized the closure as “the best outcome given the circumstances.”
