On Jan. 31, 2026 Step Finance disclosed a security breach in which some treasury wallets were compromised. CertiK onchain data shows 261,854 SOL (about $27 million) was unstaked and transferred. Step asked cybersecurity firms for help but said it does not yet know how wallets were accessed or whether user funds were affected. The platform’s governance token STEP fell more than 80% in 24 hours. Step also runs a Solana validator (whose earnings are used for STEP buybacks), aggregates DeFi positions on Solana, operates SolanaFloor, and acquired Moose Capital (now Remora Markets).

Treasury compromise with 261,854 SOL (~$27M) unstaked and moved is a concrete loss; Step publicly confirmed the breach and sought cybersecurity help while saying access vector and user impact are unknown; STEP price dropped >80% in 24 hours—facts that directly drive sell-side pressure and trading action.