Attackers compromised the personal devices of Step Finance executives and used that access to direct the Solana-based portfolio platform’s autonomous AI trading agents, which held standing permission to execute large token transfers without human approval. The agents moved more than 261,000 SOL tokens, worth roughly $27-30 million, out of the platform’s treasury and fee wallets on January 31, 2026. Only about $4.7 million was later recovered. After failing to find outside financing or an acquirer, Step Finance’s team announced the platform and its affiliated products would shut down entirely.