Step Finance treasury drained in $27–40M exploit
Step Finance · Jan 31, 2026 · Trading agent
What happened
Solana DeFi platform Step Finance's treasury was drained after attackers compromised executive devices. Estimates of losses range from ~$27M to ~$40M. Step Finance announced it would wind down operations in February 2026 after failing to recover. Primary sources describe device compromise; secondary framing attributed an AI/social-engineering angle.
Causal vector
Executive device compromise enabling illicit access to treasury keys
Source
Reported by CoinDesk. Verified against the primary report.
A per-transaction cap and a merchant allowlist would have blocked transfers to any destination not on the approved list, and an approval threshold would have escalated the first anomalous transfer to a human before the treasury was drained.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Stolen EC2 keys burn $14,000 in a single day on Amazon Bedrock
anonymous three-person agency · Jul 16, 2026
15 malicious JetBrains plugins silently exfiltrated developers' OpenAI, DeepSeek and SiliconFlow API keys
JetBrains Marketplace (third-party plugin authors) · Jun 10, 2026
Compromised LiteLLM PyPI packages harvest credentials via supply-chain attack
LiteLLM (BerriAI) · Mar 24, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 85 documented failures, one control.