Tools Crypto Exploit Tracker exploit-0068
Exploit record
Step Finance Treasury Breach
- Loss
- $30M
- Attack vector
- Access Control
- Chain
- Solana
- Sector
- Treasury
What happened
On January 31, 2026, Step Finance suffered a treasury breach of roughly $27M-30M after multiple treasury wallets were compromised and stake authority was transferred away.
Step described the route as a well-known attack vector, which usually means something operational and ugly rather than elegantly novel. Once the attacker had the relevant wallet access, they moved stake authority, unstaked, and drained a huge SOL position. The key point is that this appears to have been treasury-specific rather than a user-fund contract exploit, but $30M disappearing is still $30M disappearing.
On-chain references
- Compromised Stake Account
6G53KAWtQnZSSN6HUxnBs3yYsK1aCuJRbrcPbWGY71LL - Attack Transaction
2w8sgATZwcmRMHEsG3nutmZJrskVkp74LAwTTEyxSMBJhnZ7Ux4ticeYAYnTb6K44m1XYziPvqonSkZeukAAFadZ
Sources
- Halborn post-mortemwww.halborn.com/blog/post/explained-the-step-finance-hack-ja…
One record from the Crypto Exploit Tracker, maintained by the Security Desk. Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 15 September 2026