TLDR
- Step Finance, a prominent Solana-based DeFi aggregator, is permanently closing following a January 2026 security breach that drained $26-27M
- The shutdown encompasses three distinct platforms: Step Finance, SolanaFloor, and Remora Markets
- STEP token value has plummeted 96% post-breach, currently trading at approximately $0.00057
- Token buyback program for STEP holders and redemption process for Remora rToken holders is being implemented
- Solana’s DeFi ecosystem has seen its total value locked decline 52% from September highs to $6.3 billion
Step Finance, previously hailed as Solana’s premier DeFi interface, is permanently ceasing operations following a devastating security breach that siphoned approximately $27 million from its treasury accounts in January 2026.
The shutdown encompasses three distinct products: the flagship Step Finance platform, NFT data and media service SolanaFloor, and the trading interface Remora Markets. The development team made the announcement public on February 23 through their X account.
The security incident unfolded on January 31, when an advanced threat actor successfully compromised multiple treasury and fee collection wallets. Blockchain security company CertiK verified that 261,854 SOL tokens were unstaked and siphoned off during the attack.
According to Step Finance, the team immediately engaged leading security experts and alerted appropriate law enforcement agencies following discovery of the breach. Cryptocurrency investor Mike Dudas revealed he was contacted regarding participation in an emergency funding round but requested a comprehensive security analysis first—a report that never materialized.
According to the team’s statement, they exhaustively evaluated “every possible path forward, including financing and acquisition opportunities” during the weeks following the security breach. Unable to identify a sustainable solution, they opted to cease all operations effective immediately.
Step Finance’s Legacy
Launched in 2021, Step Finance served as a comprehensive aggregation platform, consolidating liquidity pool tokens, yield farming opportunities, and user holdings from approximately 95% of all Solana-based protocols into a unified interface. During its prime, the platform attracted roughly 300,000 monthly active users.
The platform had already initiated significant restructuring prior to the security incident. In November 2025, Step discontinued its primary dashboard functionality to concentrate resources on SolanaFloor and Remora Markets.
Remora Markets emerged from the December 2024 purchase of Moose Capital, a blockchain startup. The platform’s mission centered on introducing tokenized equity trading capabilities to Solana, featuring stocks such as Nvidia and Tesla.
The January breach effectively terminated these ambitions before full deployment.
Impact on Token Holders
Step Finance has confirmed it is implementing a buyback mechanism for STEP token holders, calculated using a snapshot captured prior to the security breach. Additionally, Remora rToken holders will have access to a redemption mechanism. The team has verified that Remora tokens maintain complete 1:1 backing.
The STEP token experienced a catastrophic 96% value loss in the immediate aftermath of the hack. Following Monday’s shutdown announcement, it declined an additional 36%. Current trading price sits at $0.00057, representing a dramatic fall from its August 2021 all-time peak of $10.20.
SOL has similarly experienced significant depreciation. At the time of the announcement, it traded around $78, reflecting a 74% decline from its January 2025 record high of $293.
Solana’s aggregate DeFi total value locked has contracted 52% since reaching its September 2025 apex. Current figures stand at $6.3 billion, per DeFiLlama data.
Step Finance co-founder George Harrap disclosed that several entities have expressed interest in acquiring components of the business, and the team remains open to pursuing legitimate acquisition proposals.
The organization concluded its announcement by expressing gratitude to its user base of millions and characterized the shutdown as “the best outcome given the circumstances.”
