Who Struck Step Finance? Treasury Breach Nets $27 Million

The loss forced a sharp market reaction, and users and investors watched prices tumble as the team moved quickly to contain the damage.

Investigators were called in right away. According to the platform’s public posts, security specialists and outside firms are helping to trace the funds. Some transfers were obvious on public ledgers; they could be followed from the compromised wallets to a set of addresses that began converting SOL.

Questions remain about how access was gained. It is not yet clear whether private keys were taken, a staking routine was exploited, or an internal process failed. The exact technical route is still being pieced together.

Markets reacted violently. The platform’s governance token fell hard, with prices dropping by more than 80% in minutes as panic spread. Traders sold quickly. Price books thinned.

Some of the moved SOL was routed to exchanges, while other amounts were split across several wallets, a pattern observers often tie to attempts at cashing out without drawing attention.

Earlier today several of our treasury wallets were compromised by a sophisticated actor during APAC hours. This was an attack facilitated through a well known attack vector.

Immediate remediation steps have been taken, and we are working closely with top security professionals.…

Accounts under direct protocol control were frozen where possible. The company said it was cooperating with authorities and sharing findings with the wider Solana community.

At the same time, public-facing channels were used to give updates as they became available, though many technical details were deliberately withheld to avoid tipping off the attacker.

A handful of security firms are conducting forensic work on the transactions. On-chain evidence will be crucial to any effort to recover assets.

Reports note that tracing is a step; recovering funds is another. Legal and regulatory routes may be explored if identifiable intermediaries or exchanges are used to move the stolen value.

Whether user funds outside the treasury were touched has been a key concern, and the company is said to be clarifying that matter.

Featured image from Unsplash, chart from TradingView