Step Finance, a popular Solana analytics agency, said its treasury was hit by a massive breach that released 261,854 SOLs from wallets tied to the platform.
The loss forced a sharp market reaction, and users and investors watched prices plummet as teams moved quickly to contain the damage.
Based on the reports, approximately 261,854 SOLs were not issued and removed from the platform on January 31, 2026, the value of which was approximately $27 million to $30 million at that time.
Breach Hits Step Financial Treasury
Detectives were called immediately. According to the forum’s public posting, security experts and external firms are helping to trace the funds. Some transfers were transparent to public ledgers; can be traced from the compromised wallets to the set of addresses that started converting the SOL.
We have seen a security breach @StepFinance_ a wallet.
261,854 SOL (~$28.9M) withdrawn after stake approval was transferred
Stay Alert! pic.twitter.com/GrxpyzI2Uv
– CertiK Alert (@CertiKAlert) January 31, 2026
Questions remain about how access was gained. It is not yet clear whether the private keys were taken, an assertion routine was exploited, or an internal process failed. The exact technical route is still being compiled.
Image: CMIT Solutions
On-Chain Indicators and Market Crashes
Markets reacted violently. The platform’s management token fell hard, with prices dropping more than 80 percent in minutes as panic spread. Traders sell quickly. Reduced price books.
Based on reports from on-chain trackers, many transactions and large swings were made in a short time window.
Some of the converted SOL was transferred to the exchange, while other amounts were divided into several wallets, pattern watchers were often arrested in attempts to withdraw money without attracting attention.
Earlier today a few of our wallets were damaged by a high profile actor during the APAC hours. This was an attack made with a known attack vector.
Corrective measures have been taken immediately, and we are working closely with top security experts.…
– Step☀️ (@StepFinance_) January 31, 2026
Social Anxiety and Functional Responsiveness
Step Finance has announced emergency measures to protect outstanding funds. Access to certain treasury functions was restricted and the control of multisigs was reviewed.
Accounts under direct protocol control have been disabled where possible. The company said it is cooperating with authorities and sharing findings with the wider community of Solana.
At the same time, public-facing channels were used to provide updates as they became available, although many technical details were deliberately withheld to avoid alerting the attacker.
Restitution and Anonymity Measures
A number of security firms conduct transactional intelligence. On-chain evidence will be critical to any asset recovery effort.
Reports note that tracking is a step; reimbursing funds is another. Legal and regulatory channels may be explored if identified intermediaries or exchanges are used to transfer stolen value.
Whether user funds outside the treasury are affected has been a major concern, and the company is said to be clarifying that issue.
Featured image from Unsplash, chart from TradingView
Planning process because bitcoinist focuses on delivering well-researched, accurate, and unbiased content. We maintain strict sourcing standards, and each page is diligently reviewed by our team of senior technical experts and experienced editors. This process ensures the integrity, relevance, and value of our content to our readers.
