2026-01 · 2026-Q1
Step Finance AI Trading Agent Treasury Drain
Should this run hold this key at all?
- Fixable
- Architectural
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Attacker
Target
Step Finance (Solana DeFi portfolio manager)
Impact
~$40M drained from treasury; 261,000+ SOL transferred; native token crashed ~97% from pre-hack levels; only ~$4.7M recovered; platform wound down operations
Root cause
Executive device compromise gave attackers wallet and fee-account access; trading agents held broad permissions across wallets, oracles, and trading endpoints with no scope isolation; 45.6% of surveyed teams reused shared API keys across agents
Sources
Catalog
Cite this: AgentProv incident record: Step Finance AI Trading Agent Treasury Drain (2026-01). https://agentprov.com/incidents/2026-01-step-finance-ai-trading-agent-treasury-drain
Related
- Also L1 · 2026-10-21LiteLLM 1.107.0 on PyPI and Docker Ships a Credential Stealer That Runs at Every Python StartupL1Credential
- Also L1 · 2026-10-17OpenCode Console Breach Exposes Users' Stored OpenAI, Anthropic, and Google API KeysL1Credential
- Also L1 · 2026-10-13IBM MCP Context Forge Shipped a Known JWT Secret, Letting Anyone Mint Platform Admin Tokens (CVE-2026-53709)L1Credential