Step Finance — Executive Device Compromise / Stake Authorization Hijack

Timeline: On 28 January 2026, the future attacker wallet (LEP1uHXcWbFEPwQgkeFzdhW2ykgZY6e9Dz8Yro6SdNu) was funded with 0.2 SOL from the Step Finance treasury itself (staging signal). On 31 January 2026 at 03:55:16 UTC, the attacker executed the transfer of Set Staker + Set Withdrawer Authority from the Step authority account (3KNZ9i1dLNNqpBTKEkTgUQs6TNCd3bzuy6HwfoXACaRs) to his wallet. Signature: 2w8sgATZwcmRMHEsG3nutmZJrskVkp74LAwTTEyxSMBJhnZ7Ux4ticeYAYnTb6K44m1XYziPvqonSkZeukAAFadZ. Initial compromise via compromised devices belonging to members of the Step executive team (not a smart contract flaw, not a Solana protocol flaw). Unstaking tx: 5EeXqPQci3ZnbFGWPJf622cLqLGnMuNcAr1rDGCizKRFt9owawCzovNpBC4xNh7A4a5p7Qkvsg8nPaYmw3MiYCvF. Main withdrawal tx (261,932 SOL): 4Ly35PsVTBNPVibpDRww6FC43pU5Tuw6UtaKECzcLKXtWTPyyvw1dw8LoNRLBDMgQUP81nN69mhiAEDJvzL8X317. On 31 January, CertiK Alert + Step Finance publicly disclosed the breach. STEP token plummeted over 80% in 24 hours per CoinDesk. On 23 February 2026, Step Finance, SolanaFloor, Remora Markets announced immediate shutdown; STEP buyback plan based on pre-incident snapshot, redemption process for Remora rToken holders (backed 1:1). STEP token: -99.12% since the incident. Endpoint security compromise on executive team devices — no smart contract exploit needed.