Step Finance closes brands after security breach

In a statement posted Feb. 23, the Solana-based dashboard and DeFi aggregator said it had explored “every possible path forward, including financing and acquisition opportunities,” but was “unable to secure a viable outcome,” leading it to end operations “effective immediately.”

Step Finance said it is preparing a buyback for holders of its native token, STEP, based on a snapshot taken before the incident, and a separate redemption process for Remora Markets rToken holders.

The wind-down follows a security incident first disclosed on Jan. 31, when Step Finance reported a breach affecting “some of our treasury wallets” and said it had brought in cybersecurity firms to assist with the investigation. A blockchain security firm publicly tracked the exploit at the time and reported that 261,854 SOL was unstaked and transferred during the incident, worth roughly $27 million at then-prevailing prices.

In a subsequent incident update, Step Finance attributed the breach to compromised devices used by members of its executive team, saying the attack did not hinge on a smart-contract exploit but on access to the organization’s operational signing environment. Step Finance later put total losses at approximately $40 million, according to reporting that cited the company’s public statements and investigation updates.

The company said it had recovered a portion of assets during the response, including roughly $3.7 million in Remora-related assets and about $1 million in other positions, attributing the recoveries to Token22 protections and coordination with partners. Step also advised users not to engage with the STEP token while the investigation was ongoing and remediation work continued, according to the same accounts of the company’s incident communications.

Remora Markets and its rTokens were a focal point of the post-incident messaging. Step Finance and related statements cited in coverage said Remora rTokens remained fully backed at a 1:1 ratio and that a redemption path would be provided for holders.

The shutdown extends beyond Step Finance’s core product. SolanaFloor, a Solana ecosystem media and analytics brand owned by Step, separately confirmed it would stop publishing new content while keeping its existing materials online as an archive. “SolanaFloor will no longer publish new content, but our existing website, videos, and newsletters will remain available as an archive,” the site said in its closure notice dated Feb. 23.

Step Finance co-founder George Harrap said there had been inbound interest in acquiring parts of the business, but indicated the team was working under time pressure as it evaluated options following the breach.

The hack and wind-down came after Step Finance had already been restructuring its broader group. In a Nov. 4, 2025 post outlining “Step Group Changes,” Step Finance said it was “sunsetting the Step Dashboard, APIs, and Mobile App” and shifting focus to SolanaFloor and Remora, describing the dashboard infrastructure as costly to maintain and difficult to monetize. The post also described Step Finance as an early Solana project and said the dashboard had reached “millions of users” over its lifecycle.

Market reaction around the incident was severe. STEP fell sharply in the days after the hack and then dropped again after the wind-down announcement, with pricing data cited in reporting showing the token near fractions of a cent and far below its 2021 peak. The broader Solana DeFi backdrop has also been under pressure, with on-chain data referenced in the same report showing Solana DeFi total value locked down roughly half from a prior peak.