Step Finance Confirms Unauthorized SOL Transfers Following Security Incident

A $29M SOL treasury outflow triggered a STEP price drop and added pressure to ongoing security concerns across Solana DeFi.

Step Finance has confirmed unauthorized SOL transfers following a security breach involving several internal wallets. Treasury-linked accounts were impacted, and investigators are reviewing the activity. Market activity indicates a large volume of SOL unstaked and moved over a short period. 

On-Chain Data Flags Major SOL Outflows From DeFi Treasury

On-chain records reviewed by CertiK show that roughly 261,854 SOL were unstaked and moved during the incident. With SOL trading near $110 at the time, the transfers were valued at an estimated $29 million. Step Finance later acknowledged the breach in a post on X, confirming that multiple treasury wallets were accessed without authorization and are still under review.

So far, the project has not identified how the wallets were compromised. Possible causes include leaked private keys, faulty permissions, or other internal weaknesses. Step Finance has asked cybersecurity firms to assist with the investigation.

On-chain data and public disclosures have also confirmed several known facts:

• About 261,854 SOL left treasury-linked wallets after being unstaked.
• Transfers occurred over a short time window, suggesting coordinated access.
• Step Finance brought in external security teams soon after detecting the issue.
• User fund exposure and recovery status remain unconfirmed.

The Solana ecosystem has been hit by several security incidents over the past twelve months. In April, lending protocol Loopscale lost $5.8 million to an exploit shortly after hitting the market. A few months later, decentralized CrediX suffered a $4.5 million breach after an attacker gained admin wallet control.

That same year, the Solana network was also affected by a $37 million hack on South Korean exchange Upbit. Blockchain analytics firm Chainalysis reported more than $3.41 billion in crypto theft during 2025. While total value locked across DeFi rebounded, losses from hacks remained steady throughout the year.

STEP Slides Hard as Investors React to Treasury Wallet Compromise

STEP, the platform’s native token, reacted sharply after news of the breach spread. The asset dropped more than 60%, falling to about $0.023. Traders cited uncertainty around treasury losses and long-term funding as key drivers behind the sell-off.

Step Finance operates its validator and allocates a portion of rewards to STEP buybacks. Those tokens are then shared with users staking xSTEP. Missing SOL from treasury wallets could limit those purchases and weigh on confidence around the token’s future.

Meanwhile, the crypto market recorded heavy losses last month. According to CertiK, about $370.3 million was recorded stolen during the month. Phishing schemes accounted for most of the damage at $311.3 million, while code flaws caused another $51.5 million. However, recovery efforts remain slow, with only a small fraction of funds recovered so far.