hackingincidents

• Step Finance reported a security breach involving 261,854 SOL (approximately $27 million) in its treasury wallets, which is currently under investigation.
• The DeFi portfolio tracker platform disclosed the incident on X, seeking assistance from cybersecurity firms while not specifying how the breach occurred.
• The platform's governance token (STEP) plummeted over 80% following the announcement amid a wider crypto market drawdown.

Step Finance, a decentralized finance (DeFi) portfolio tracker built on Solana, said some of its treasury wallets were compromised in a security breach under active investigation.
Onchain data shared by blockchain security firm CertiK shows that 261,854 $SOL , worth roughly $27 million at current prices, was unstaked and transferred during the incident.
The platform disclosed the breach in a post on X and asked cybersecurity firms to assist with the investigation. It did not specify how the attacker gained access or whether user funds were affected.

The platform's governance token, STEP, dropped over 80% in the last 24 hours, according to SoSoValue data. Step also operates a validator node on Solana and uses validator earnings to fund STEP token buybacks.
Founded in 2021, Step Finance aggregates yield farms, LP tokens and DeFi positions across nearly all Solana protocols into a single dashboard.

It also runs SolanaFloor, a Solana-focused media outlet, and organizes the Solana Crossroads conference. In late 2024, it acquired Moose Capital (now Remora Markets) and plans to offer tokenized equity trading on Solana.
#solana #HackingIncidents #MarketCorrection #USGovShutdown

SlowMist, sebuah perusahaan yang beroperasi di bidang keamanan blockchain, telah menerbitkan analisisnya mengenai peristiwa keamanan untuk kuartal keempat tahun 2025.
Laporan tersebut memperingatkan pengguna tentang munculnya kembali serangan malware terbaru dan metode phishing yang lebih canggih.
Menurut SlowMist, penyerang sedang menggunakan teknik baru yang disebut "pencemaran riwayat browser." Dalam metode ini, bahkan jika pengguna mengetikkan nama domain resmi platform secara manual, fitur otomatisasi peramban dapat mengalihkan mereka ke situs palsu. Beberapa korban melaporkan telah memasukkan alamat dengan benar, tetapi peramban secara otomatis menyelesaikan nama domain palsu yang telah dibuat sebelumnya. Laporan tersebut secara khusus menyatakan bahwa hal ini bukan disebabkan oleh kesalahan pengguna. Dijelaskan bahwa penyerang "mencemari" riwayat browser terlebih dahulu melalui iklan, redirect media sosial, atau pengumuman palsu, sehingga nama domain palsu tersebut tersimpan dalam sistem otomatisasi peramban. Ketika pengguna mengetik alamat yang sama lagi, peramban secara otomatis mengalihkan mereka ke situs phishing yang memiliki antarmuka hampir identik dengan situs resmi.