On January 31, 2026, Step Finance — a Solana DeFi analytics and yield aggregation platform — lost approximately $40 million when attackers compromised executive team devices and drained the protocol's treasury wallets. No smart contract bug was exploited. No flash loan was used. The attacker simply had the keys.

By February 23, Step Finance,...