TLDR:
- Step Finance hacked, losing $30M in SOL through compromised treasury wallets.
- The attack affected treasury wallets only; the $STEP token collapsed by over 84% afterward.
- Recent Solana DeFi hacks follow similar vectors: wallet compromise, key leaks, and access flaws.
- Investigation underway with cybersecurity firms helping track stolen SOL and secure assets.
Step Finance was hacked after multiple treasury wallets were compromised, resulting in a loss of around $30 million in SOL. The Solana-based DeFi platform confirmed the attack on X and is investigating.
Cybersecurity firms have been contacted, while the $STEP token collapsed drastically. The incident underscores ongoing operational risks affecting Solana DeFi projects and protocol-held funds.
Treasury Breach and Token Collapse
Step Finance hwas acked saw attackers gained access to multiple treasury and fee wallets. About 261,854 SOL was transferred to unknown addresses.
The total value of the stolen tokens was roughly $30 million at the time. The breach focused on protocol funds, leaving user wallets untouched.
Step Finance confirmed the attack on X, stating an investigation is ongoing. The team also reached out to cybersecurity firms for assistance and asked the community for support.
There has been a breach of security for some of our treasury wallets hours ago and we are currently investigating
More information will be posted at a later stage
— Step
(@StepFinance_) January 31, 2026
The market reacted immediately. According to Coingecko, the $STEP token dropped and is trading around $0.004. Market capitalization fell to approximately $1.3 million, placing the token firmly in micro-cap territory.
Liquidity tightened, and volatility increased sharply. Trading patterns show calm activity before mid-day, followed by a vertical price collapse.
The price declined by over 80% in one session, slicing through every support level. Minor reflex bounces occurred but failed to reverse the downward trend.
Fee activity showed jagged peaks in early 2025, with highs near $150k–$160k, reflecting hype-cycle behavior and speculative activity. Post-attack activity has slowed considerably. Fees and trading volumes dropped, indicating fading momentum.
The market reflects a structural reset rather than a temporary dip. $STEP token’s current price reflects defensive buying and weak investor conviction.
Historical Context and Similar DeFi Exploits
Step Finance’s hack aligns with past Solana DeFi breaches. Common attack vectors include treasury wallet compromise, private key leaks, and access control flaws.
CrediX lost $4.5 million after an administrator’s wallet was compromised. Loopscale suffered a $5 million loss shortly after launch but reached a parley with hackers for a 10% recovery.
The Upbit Solana-related hack in November 2025 saw over $35 million stolen from a hot wallet due to poor access control. The Step Finance breach emphasizes that operational compromises target protocol-held funds.
Unlike smart contract exploits affecting user assets, these breaches are internal and highly disruptive. The incident reinforces the need for robust treasury security measures.
Step Finance’s ongoing investigation and cybersecurity outreach aim to recover assets and prevent further attacks. Solana DeFi protocols must enhance access controls and internal monitoring to reduce repeated operational risks.
The post Solana DeFi Breach Sees Step Finance Lose $30M as Treasury Wallets Exploited appeared first on Blockonomi.
Source: https://blockonomi.com/solana-defi-breach-sees-step-finance-lose-30m-as-treasury-wallets-exploited/