Solana DeFi hack drains $26M treasury

TLDR

Solana DeFi portfolio tracker Step Finance has suffered a major treasury hack involving roughly $2627 million in SOL.

1. Step Finance reports its treasury wallets were compromised, with about 261,854 SOL unstaked and moved, and the root cause still under investigation.
2. The STEP governance token has crashed over 80%, raising questions about project runway, validator operations, and future buybacks.
3. The incident highlights lingering key-management risks in Solana DeFi and comes during a broader crypto selloff, so a clear post-mortem and recovery plan are critical to watch.

Confidence: high because multiple independent reports and onchain data agree on the scale and core details.

Deep Dive

1. Hack Details And Scale

Step Finance, a Solana-based DeFi portfolio tracker, has confirmed that several of its treasury and fee wallets were compromised, with onchain data showing about 261,854 SOL (roughly $2627 million) unstaked and transferred during the breach. Blockchain security firm CertiK and several outlets report the same SOL amount and timing, making this one of the larger treasury-focused incidents on Solana in recent months.

The team disclosed the breach in a post on X and said it is working with external cybersecurity firms and authorities, but has not yet explained how the attacker gained access or whether any non-treasury user funds were directly affected. One report notes that the compromise appears confined to project-controlled wallets so far, but this has not been definitively ruled out.

2. Impact On Step Finance

Following the announcement, Step Finances governance token STEP dropped more than 80% within 24 hours, according to market data cited in multiple reports, reflecting a sharp loss of confidence in the project. Step also operates a Solana validator node and historically used validator rewards to buy back STEP, so a drained treasury directly threatens those buybacks and its ability to fund ongoing operations.

Because Step is primarily an aggregator and dashboard, users DeFi positions typically sit in other Solana protocols, not in Step-controlled custodial wallets, which may limit direct user balance losses. However, the hit to the treasury, the token price crash, and uncertainty over the attack vector all raise questions about whether the project can sustain its broader ecosystem activities, such as SolanaFloor and events like Solana Crossroads.

3. Broader Solana DeFi Risks

The hack lands during a period when Solana (SOL) itself has sold off in double-digit percentage terms amid a wider crypto drawdown, making it harder to separate project-specific risk from broader market stress. The incident underlines that even well-known ecosystem tools remain exposed to non-smart-contract risks such as compromised treasury keys, validator accounts, or operational security lapses.

For Solana DeFi users, this reinforces the need to distinguish between: (1) protocols that custody funds via smart contracts and (2) ancillary platforms whose treasuries and operations still depend on traditional key management and offchain processes. A clear technical post-mortem, disclosure on whether any user-related wallets were touched, and a realistic recovery or compensation plan will be key signals of how much lasting damage this causes to Step and confidence in Solanas DeFi stack.

Conclusion

The Step Finance treasury breach is a sizable, project-level shock inside the Solana ecosystem, hitting roughly $2627 million in SOL and crushing the STEP token. The long-term impact will depend on what the investigation reveals about the attack vector, how contained the damage is to project funds, and whether the team can credibly rebuild security and capital buffers in an already risk-off market.