What Did These Platforms Actually Do?What Happened in the January Hack?What Happens to Token Holders?How Did the Market React?What Does This Mean for Solana DeFi?
Step Finance, SolanaFloor, and Remora Markets are shutting down all operations effective immediately. The team confirmed the closure on February 23, 2026, via an official post on X, citing the fallout from a late-January security breach that drained roughly $29 million from the platforms’ treasury wallets.
Despite weeks of searching for a way forward, including talks with potential buyers and investors, no deal came through. Three platforms that once formed a key part of the Solana ecosystem are now gone.
Step Finance launched in 2021 and quickly earned the nickname “the front page of Solana.” It was a DeFi dashboard and portfolio tracker that pulled data from dozens of Solana protocols into one place. Users could monitor tokens, LP positions, staked yields, and wallet activity without jumping between apps.
SolanaFloor operated as a Solana-focused media and analytics outlet. It covered DeFi, NFTs, market trends, and ecosystem news. What started as a small X account grew into one of the most-read Solana news platforms in the space.
Remora Markets ran as a tokenized equities platform that allowed users to trade real-world assets like stocks on-chain. Together, these three brands served millions of users over the years.
Last November, Step Finance actually restructured its operations. It retired the Step Dashboard, APIs, and mobile app to focus on its higher-growth brands: SolanaFloor and Remora. That pivot now ends alongside everything else.
On January 31, 2026, Step Finance reported that several treasury and fee wallets had been compromised. The team described the attacker as a “sophisticated actor” who breached executive devices during APAC hours.
This was not a smart contract exploit. The attacker gained access through endpoint security weaknesses. The compromise came from the human side, likely through phishing or device infiltration, rather than a flaw in the code itself.
Blockchain security firm CertiK confirmed that approximately 261,854 SOL tokens were unstaked and transferred during the attack. At the time, that amount was worth roughly $29 million based on SOL’s price. Some reports have placed total losses as high as $40 million when accounting for all affected assets and price fluctuations.
The team worked with cybersecurity experts and managed to recover about $4.7 million using Solana’s Token22 protections and partner support. But the remaining damage proved too deep to overcome.
The team laid out two remediation plans in its shutdown announcement:
No timeline has been shared yet, but the team said more details are coming soon.
SolanaFloor separately noted that while it will stop publishing new content, its existing website, videos, and newsletters will stay online as an archive.
The STEP token collapsed. After the January hack, it dropped over 96% in value, falling from pre-hack levels to around $0.0006. Following the shutdown announcement, it fell an additional 35%, hitting a new all-time low near $0.00055 to $0.00059 on February 24, per CoinGecko. The token’s market cap now sits under $200,000.
SOL itself has been under pressure in early 2026. The token was trading around $76 on February 24, down roughly 45% from its January highs. While the Step Finance situation contributed to negative sentiment, SOL’s broader decline reflects wider market conditions and large token unlock events.
Community reactions on X were mixed. Some users offered sympathy and expressed interest in acquiring or reviving parts of the platforms. Others accused the team of poor security practices, with a few going as far as labeling the incident a rug pull. Step Finance co-founder George Harrap posted that his priority was finding roles for the team and that he would pursue acquisition offers if serious parties came forward.
This shutdown removes three established names from the Solana ecosystem in one stroke. Step Finance was a core utility layer for tracking on-chain activity. SolanaFloor was a go-to source for ecosystem news. Remora Markets was pushing into real-world asset tokenization.
The closure also highlights a recurring vulnerability in DeFi: endpoint security. Smart contracts can be audited and hardened, but when attackers target the humans behind the wallets, even battle-tested protocols can fall. Industry figures have called for a full post-mortem to share lessons on the attack vector.
Solana’s DeFi ecosystem is not collapsing. The network still holds roughly $9 billion in TVL and generates millions in daily dApp revenue. But incidents like this erode trust and remind everyone that security in crypto extends far beyond the code.
