Solana DeFi hack moves $26M SOL

TLDR

Solana DeFi dashboard Step Finance has confirmed a treasury breach where about 261,854 SOL, roughly 26-30 million dollars, was unstaked and moved from project wallets.

1. Step Finance reported that several treasury wallets were compromised, with onchain data showing 261,854 SOL unstaked and transferred during the incident.
2. The loss hit Steps own treasury and governance token hardest, while broader SOL price moves still appear driven mainly by the wider market selloff.
3. The key unknowns are how the attacker got access, whether any user funds are impacted, and whether exchanges or regulators can help freeze or recover funds.

Deep Dive

1. How The Step Finance Hack Unfolded

Step Finance, a Solana-based DeFi portfolio tracker, disclosed that multiple treasury and fee wallets were compromised and that roughly 261,854 SOL were unstaked and moved in one incident, worth about 26-30 million dollars at the time of attack. Onchain traces cited by security firm CertiK and several outlets show this SOL being unstaked and transferred out in large chunks, matching Steps own statement about a treasury breach.

Reports describe the incident as a targeted treasury hack, not an onchain exploit of a specific smart contract, and Step has asked external security firms and authorities to assist with investigation in public posts on X and in coverage of the 26M SOL hack.

2. Impact On Step, Users, And SOL

Coverage indicates the stolen funds were Steps treasury assets, with no confirmed evidence yet that ordinary user wallets or deposits on other protocols were drained. That said, Step has not fully ruled out knock-on effects and is still clarifying whether any non-treasury funds were touched in the treasury breach.

The immediate market impact was most visible in STEP, Step Finances governance token, which dropped more than 80 percent in 24 hours after the disclosure, reflecting a sharp loss of confidence in its tokenomics and runway. By contrast, SOL itself was already falling double digits amid a broader crypto drawdown, with analysts framing the hack as an additional confidence hit rather than the primary driver of Solanas price move.

3. Key Unknowns And What To Watch

Several critical details remain unclear: how the attacker obtained control over staking or treasury keys, whether the breach involved private key compromise or operational failures, and whether any internal controls were bypassed. Step has described the actor as sophisticated and says a well known attack vector was used, but technical specifics have not yet been disclosed in public writeups such as this treasury hack recap.

Onchain analysis shows the stolen SOL split across multiple wallets and partially routed toward exchanges, a common laundering pattern that may still leave traces regulators and exchanges can act on if addresses are flagged quickly. For Solana DeFi users more broadly, the near-term signals to watch are: Steps next incident report, any confirmation about user-fund safety, exchange freeze or recovery attempts, and whether other Solana protocols announce reviews or upgrades to treasury and validator key management.

Conclusion

A roughly 26-30 million dollar theft from Step Finances Solana treasury is a serious, but contained, DeFi security failure centered on a single projects wallets. The largest damage so far is to Steps treasury and governance token, while SOLs broader selloff remains primarily macro-driven, with the hack adding a layer of headline and trust risk. The investigation outcome and any follow-on changes to treasury security across Solana projects will determine whether this stays an isolated incident or becomes a catalyst for wider DeFi risk repricing on Solana.