What happened
On January 31, 2026, Step Finance disclosed a compromise of treasury and fee wallets on Solana. The project later reported approximately $40 million drained.
Technical root cause
Step Finance attributed the incident to compromised executive devices. It did not report a smart-contract vulnerability as the cause.
How it happened
Compromised treasury wallets had stake authority transferred to attacker-controlled accounts, after which SOL was unstaked and moved out.
Protocol details
Classification
Infrastructure / Other / Key Compromise
Protocol Type
Portfolio Tracker
Implementation language
Rust
Protocol links
Website
@StepFinance_
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
