Step Finance $27M post-mortem: what a per-transaction cap would have done

In January 2026, Step Finance — a Solana DeFi platform — lost between $27 million and $40 million in treasury funds after attackers compromised executive devices. The company shut down operations in February. It is the largest documented financial incident of 2026 with an AI-adjacent component.

What happened

The primary vector was device compromise — attackers gained control of credentials that could authorize treasury movements. But the scale of the loss — $27M+ transferred before detection — is the signature of an automated drain, not a manual heist. A human attacker pauses, checks, extracts incrementally. An automated drain empties the account in seconds.

This is the pattern we see across trading-agent incidents in our database: the $441K tweet-misread transfer, the $1M Clawdbot loss, the $70K WalletConnect drain. The common element: a transfer that should have been impossible executes because there is no external gate between intent and completion.

The firewall rules that would have caught it

Rule 1: Per-transaction cap. No single transfer above the cap is allowed, regardless of credential state. A $27M treasury drain is, at minimum, made of many transactions. Each one trips the cap.

Rule 2: Merchant allowlist. Only pre-approved destination addresses can receive funds. A compromised credential can't send to an unknown address, period. The firewall returns BLOCKED before the transaction leaves the platform.

Rule 3: Approval threshold. Any transfer above a ceiling (say, $100K) is FLAGGED for human approval. The transfer waits for a confirm. A $27M drain becomes a $100K observation — still damaging, not catastrophic.

The hard lesson of Step Finance is that credentials will be compromised. The control question is: when they are, does the system constrain what can be done with them? A spend firewall — one deterministic call before every transaction — is the answer.