Step Finance, a Solana-based DeFi (Decentralized Finance) platform, confirmed that a sophisticated hacker attack occurred on multiple of their treasuries and fee wallets on February 1. The attack successfully stole 261,854 SOL tokens, equivalent to $30 million.
According to a report by blockchain security firm CertiK, the stolen SOL tokens were withdrawn to an unknown wallet address. Meanwhile, through on-chain data analysis by Solana media company Solana Floor, it was discovered that the stolen SOL tokens were unstaked and then transferred during the incident. This means that the attackers gained authorization to control an ongoing staking process.
Also Read: Decentralized Finance (DeFi): Definition & How It Works
Step Finance immediately responded to the issue through a series of social media posts. The DeFi platform activated emergency protocols and worked with cybersecurity experts to review and address the case.
The Step Finance team emphasized that user funds remain safe. However, many are wondering whether this attack was purely the result of a security system failure or a disguised exit scam. This is because the attackers appeared to have direct access to the wallet through the unstaking process, rather than exploiting a smart contract vulnerability.
The impact of this attack did not stop at Step Finance but also affected related platforms. One of them was the Remora Markets protocol. Step Finance is a major liquidity provider (LP) for Remora Markets, so some of the assets affected at Step Finance belonged to Remora Markets, namely Remora rStocks.
Also Read: What is Liquidity Pool: Definition, How It Works, and Its Role in DeFi
As the investigation continues, Remora Markets emphasizes that Remora assets remain pegged 1:1 in their brokerage accounts.
This case immediately triggered panic in the market. Step Finance's native token, STEP, fell more than 90% in 24 hours. Traders and investors abandoned this asset amid uncertainty about the future of Step Finance and the legitimacy of the case.
