Solana DeFi Aggregator Shuts Down After $40M Hack

Solana-based DeFi aggregator Step Finance has announced it will immediately cease all operations following a major security breach in late January.

After several weeks of exploring financing and acquisition options, the team confirmed it was unable to secure a sustainable recovery plan.

Scope of the Shutdown

The shutdown affects all projects operating under the Step Finance umbrella.

This includes the Step Finance Dashboard, the platform’s core portfolio management and analytics tool widely used across the Solana ecosystem. It also includes SolanaFloor, a prominent Solana-focused media and NFT analytics platform, as well as Remora Markets, a tokenized equities trading platform that Step acquired in 2024.

The closure marks one of the most significant operational collapses within Solana’s DeFi landscape this year.

The $40 Million Security Breach

The crisis stems from a January 31, 2026 security incident.

Investigators concluded the breach was operational rather than structural. Instead of exploiting smart contract vulnerabilities, attackers reportedly compromised personal devices belonging to executive team members. This allowed access to critical authentication credentials, which were then used to drain treasury and fee wallets.

Initial reports estimated losses at $29 million (around 261,854 SOL), but subsequent assessments confirmed total losses across assets reached nearly $40 million.

Through coordination with ecosystem partners and leveraging Solana’s Token22 protections, approximately $4.7 million was recovered. However, this was not enough to restore financial stability.

Impact on STEP Token and Users

The fallout was immediate.

The native STEP governance token collapsed more than 97% after the hack and was trading near $0.00058 at the time of the shutdown announcement.

To mitigate damage, the team is preparing a buyback program for STEP holders based on a snapshot taken prior to the January 31 breach.

Meanwhile, Remora Markets confirmed its rTokens remain fully backed on a 1:1 basis. A redemption process is being established to allow users to exchange those tokens for USDC.

Bigger Picture

The incident highlights the growing importance of operational security in crypto. While smart contract audits often receive the spotlight, this breach underscores how executive-level device compromises can pose equally devastating risks.

For Solana’s DeFi ecosystem, the shutdown of Step Finance represents both a financial loss and a reputational setback, reinforcing the need for stronger security standards beyond just on-chain code.

The post Solana DeFi Aggregator Shuts Down After $40M Hack appeared first on ETHNews.