Breaches and incidentsBriefConfirmed by two or more outlets
Step Finance: executives’ devices compromised, treasury drained
31 Jan 2026 (APAC hours): about 261,854 SOL unstaked and moved.
- Disclosed
What happened
- 31 Jan 2026 (APAC hours): about 261,854 SOL unstaked and moved. Step put total losses at about USD 40M; CertiK first estimated about USD 28.9M.
- Root cause per Step: its executive team’s devices were compromised through “a well-known attack vector”, giving access to treasury and fee wallets. No further detail. Smart contracts were not breached.
- Attribution: none.
- Response: authorities notified. About USD 3.7M in Remora assets and USD 1M in other positions recovered. Step announced on 23 to 24 Feb it was shutting down.
Sources
- https://www.bleepingcomputer.com/news/security/step-finance-says-compromised-execs-devices-led-to-40m-crypto-theft/
- https://www.scworld.com/brief/step-finance-loses-40-million-in-executive-device-hack
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.