Step Finance Treasury Breach on Solana Sees About $29 Million in SOL Unstaked

An active probe with outside security firms is tracing 261,854 SOL moved off treasury wallets, with user exposure still unconfirmed.

Overview

Step Finance confirmed a compromise of multiple treasury and fee wallets and launched an investigation after a rapid on-chain unstaking and transfer.
On-chain data tracked by CertiK and independent analysts shows 261,854 SOL—valued between $27 million and $30 million—was removed and moved to external addresses.
The STEP governance token plunged sharply following the disclosure, with outlets reporting declines ranging from more than 60% to over 80%.
The team has not disclosed how access was gained or whether user funds were affected, though reporting notes the pattern suggests direct wallet access rather than a smart-contract exploit.
Loss of treasury assets raises concerns about validator-revenue-funded STEP buybacks and the project’s runway, reinforcing broader scrutiny of treasury and key management across Solana DeFi.