$30M SOL Vanishes as Step Finance Confirms Wallet Hack

Step Finance confirms a wallet hack after $30M SOL was unstaked and transferred, raising security concerns across Solana DeFi ecosystem.

Step Finance confirmed a security hack after unauthorized activity impacted several treasury and fee wallets. As a result, significant SOL outflows were detected and they immediately launched their investigation and external cybersecurity engagement.

Step Finance Confirms Treasury Wallet Hack After Major SOL Outflow

According to Step Finance, the incident took place during a short period of time and is still under investigation. Moreover, the team said there will be further disclosures as the forensic analysis progresses.

There has been a breach of security for some of our treasury wallets hours ago and we are currently investigating

More information will be posted at a later stage

— Step☀️ (@StepFinance_) January 31, 2026

On-chain data showed that about 261,854 SOL was unstaked and moved during the breach. At that time the value of assets transferred amounted to almost $30 million.

The breach was publicly recognized through official social media communication channels. Additionally, Step Finance assured that several treasury wallets gotten affected during the incident.

The team stressed that cybersecurity companies were called upon to help with technical analysis work. Therefore, incident containment and attribution efforts are now under way with external specialists.

Blockchain observers said that the unstaking process preceded the fund transfers. Consequently, analysts suggested, the activity seemed to be deliberate rather than an automated exploit.

However, where the transferred SOL ends up at this stage is still unknown. Furthermore, no recovery timeline and attribution details have been publicly shared.

Step Finance went on to clarify that the investigation is still active and ongoing. Meanwhile, the platform encouraged users to wait for authentic verified updates through official channels of communication.

The incident instantly raised issues all through the Solana DeFi ecosystem. Treasury wallets often store protocol revenue which makes them attractive targets for attackers.

Despite the magnitude of the outflow, Step Finance has not confirmed exposure of user funds. The platform mainly offers analytics and portfolio services and not custodial services.

Security Risks Reemerge Across Solana DeFi After $30M Incident

Security analysts pointed out that there were more treasury wallet breaches throughout 2025 across various blockchain ecosystems. Therefore, risk management practices have become one of the primary concerns for the industry.

Hot wallets and functioning treasuries are common attack targets in times of volatile markets. As the balances of protocols continue to increase, the incentives for the attacker also continue to increase.

Community reactions differed after the incident was disclosed. Some users demanded more clarity while others called for patience until forensic conclusions.

Market observers pointed out that rapid unstaking implied previous wallet access. However, definitive conclusions need to be made by deeper on-chain and off-chain investigation.

Step Finance reiterated its commitment to transparency during the investigation process. The team said that updates would be provided after findings were proved and verified.

Industry experts emphasized the need for multiple layers of security controls for protocol-owned funds. Multisignature arrangements and real-time monitoring are nonetheless crucial safeguards.

The breach follows a larger trend of treasury-driven hacks across platforms in decentralized finance. Attackers have been increasingly targeting institutional scale wallets as opposed to individual user accounts.

With DeFi adoption growing, treasury security is a structural vulnerability. Therefore, protocols receive increasing pressure to increase custody frameworks and response preparedness.

Step Finance continues working along with cybersecurity partners to evaluate potential damage. Additionally, internal security procedures are expected to be subject to review after the incident.

The event highlights ongoing dangers with decentralized financial infrastructure. As a result, treasury protection has become one of the highest priorities worldwide across all Solana based projects.

While investigations are underway, the $30 million transfer of SOL is a cautionary signal. It notes the shifting threat landscape facing modern decentralized platforms.