Statement on Recent Security Incident
In the early afternoon hours of 31 January (APAC), approximately $40M was drained from the Step Finance treasury. This was a result of our executive team’s devices being compromised.
Immediately after detecting the breach, we began working with leading cybersecurity researchers and relevant authorities to contain the incident, secure remaining systems, and investigate the attack. Law enforcement has been notified and we are cooperating fully.
To protect users and partners, we temporarily halted several operational activities while security measures were reinforced. Step Finance was the largest liquidity provider to Remora Markets, and LP activities will resume once systems are fully secured. Remora Markets remains isolated from this incident, and all rTokens remain backed 1:1 with custodial collateral.
Through built-in security protections in Token22 and rapid coordination with partners, Step Finance was able to recover approximately $3.7M in Remora assets and $1M in other positions at the time of writing.
We understand the seriousness of this situation and the impact it has on our community. We ask for your patience as we work with our partners to determine the safest and most responsible path forward. All official updates regarding this incident will be shared exclusively through this account.
At this time, we do not recommend anyone engage with the STEP token until our investigation is complete. A snapshot will be taken from before the exploit, and we are actively working on a solution for STEP token holders. We will share further updates as soon as they are finalized.
We are deeply grateful for the support from members of the Solana ecosystem and from our community. Our focus now is on security, recovery, and rebuilding with stronger safeguards in place.
Regards,
Step Team
