Key Takeaways
- Step Finance, a prominent Solana DeFi aggregator, announced permanent closure following a $26-27M January 2026 security breach
- The shutdown impacts Step Finance, SolanaFloor, and Remora Markets simultaneously
- STEP token value plummeted 96% following the exploit, currently trading at $0.00057
- Buyback programs for STEP holders and redemption options for Remora rToken holders are being implemented
- Solana’s DeFi ecosystem total value locked declined 52% from September peak, now at $6.3 billion
The Solana ecosystem’s premier DeFi dashboard, Step Finance, has announced the permanent cessation of operations following a January 2026 security breach that resulted in approximately $27 million being stolen from treasury wallets.
The shutdown encompasses three distinct platforms: the Step Finance dashboard, the NFT analytics and media platform SolanaFloor, and the trading venue Remora Markets. On February 23, the team made the announcement public through X.
On January 31, attackers described as “sophisticated” successfully compromised multiple treasury and fee wallets. Blockchain security company CertiK verified that 261,854 SOL tokens were unstaked and moved during the attack.
Following the incident, Step Finance reached out to leading security experts and informed appropriate authorities. Crypto investor Mike Dudas revealed he was contacted regarding participation in a bridge funding round, requesting a comprehensive security analysis that was never provided.
In the weeks following the hack, the team evaluated “every possible path forward, including financing and acquisition opportunities.” After failing to identify a sustainable solution, the decision was made to terminate all operations effective immediately.
Step Finance Background and Evolution
Launched in 2021, Step Finance consolidated liquidity pool tokens, yield farms, and user positions from approximately 95% of Solana-based protocols into a unified dashboard interface. During its peak period, the platform served roughly 300,000 monthly active users.
Restructuring efforts had already begun prior to the security breach. In November 2025, Step discontinued its primary dashboard operations to concentrate resources on SolanaFloor and Remora Markets.
Remora Markets emerged from the December 2024 acquisition of Moose Capital, a startup venture. The platform’s goal centered on introducing tokenized stock trading to the Solana network, featuring equities such as Nvidia and Tesla.
The January security breach halted these initiatives before reaching full operational status.
Token Holder Compensation Plans
Step Finance announced plans to execute a buyback program for STEP token holders using a pre-hack snapshot as reference. Remora rToken holders will receive access to a redemption mechanism. The team verified that Remora tokens maintain full 1:1 backing.
The STEP token experienced a 96% value decline in the immediate aftermath of the breach. Following Monday’s shutdown announcement, the token fell an additional 36%. Current trading price sits at $0.00057, dramatically lower than its August 2021 all-time high of $10.20.
SOL has experienced significant depreciation as well. At the time of the announcement, SOL traded around $78, representing a 74% decrease from its January 2025 all-time high of $293.
Solana’s aggregate DeFi value locked has contracted 52% since reaching its September 2025 peak. Current measurements place it at $6.3 billion, based on DeFiLlama data.
Step Finance co-founder George Harrap indicated that several parties expressed interest in acquiring portions of the business, with the team prepared to explore genuine opportunities.
The company concluded its announcement by expressing gratitude to its millions of users and characterized the shutdown as “the best outcome given the circumstances.”
