The Agents Emptied the Treasury in One Session

🔴 REAL INCIDENT: Step Finance — AI trading agents drain $27M treasury after executive device compromise (January 31 – February 24, 2026)

What Happened

Step Finance was a Solana-based DeFi portfolio manager — the kind of platform that aggregates positions across protocols and lets treasury operators rebalance without clicking through six interfaces. Like most of its peers in 2025–2026, it had automated the rebalancing itself. AI trading agents monitored positions, evaluated conditions, and executed transfers.

The agents were good at their job. That was the problem.

On January 31, 2026, attackers who had compromised executive devices at Step Finance reached the agent control plane. They did not need to find a bug in the agents. They did not need to jailbreak a model or craft a prompt injection. They needed only to be standing where an authorized operator normally stands, because from that position the agents already had everything required: permission to execute large SOL transfers, and no obligation to ask anyone first.

More than 261,000 SOL — roughly $27 to $30 million depending on which hour you priced it — moved out of the treasury. The transfers were not anomalous from the system's point of view. They were the kind of operation the agents performed routinely, at a size the agents were routinely permitted to perform.

The STEP token fell 97%. Approximately $4.7 million was eventually recovered. On February 24, 2026 — twenty-four days after the incident — Step Finance announced it was shutting down all operations.

The company did not survive its own automation.

The Technical Breakdown

There is a temptation to file this under "crypto hack" and move on. That framing misses what is actually transferable to every enterprise running agents against a financial system.

The agents were not the vulnerability. The agents were the payload. The initial compromise was mundane — endpoint malware on executive devices, the same vector that has worked for twenty years. What made it catastrophic was what sat downstream of those devices. In a pre-agent architecture, an attacker on a finance executive's laptop still has to move money through systems that impose their own friction: dual authorization, transfer limits, a treasury workflow with a second signer, a batch window. Each of those is a place a human notices something.

Step Finance had automated that friction away. The agents existed precisely to remove the human step from rebalancing. When the attacker arrived, the friction they would have had to defeat had already been deleted, on purpose, as a feature.

Standing authority is the core design flaw. The agents held persistent permission to move large balances. Not permission granted per transaction, not permission scoped to a specific rebalance, not permission that expired — standing authority, always live, waiting for an instruction. An agent with standing authority is functionally a signed blank check sitting in a drawer that anyone with the room key can reach.

This is the same structural failure as the PocketOS volume deletion, where an agent's reachable credentials became a capability it exercised, and the same one as the Claude Code terraform destroy, where unrestricted production credentials turned a cleanup task into an infrastructure wipe. The difference here is that an attacker, not a misreasoning model, held the handle.

No isolation between agent tiers. Reporting on the incident consistently notes that the agents lacked proper isolation — the same permission envelope covered routine small rebalances and treasury-scale movements. There was no tier at which a transfer became large enough to require something the agent could not supply on its own. A $900 rebalance and a $27 million exit used the same authorization path.

Velocity removed the detection window. Human treasury fraud leaves time. Someone has to initiate, someone has to approve, batches settle on a schedule, and somewhere in that sequence a controller looks at a number that seems wrong. Agent-executed transfers complete at API speed. By the time any dashboard rendered the new balance, the balance was already the new balance.

The Broader Pattern

Cyera's research on real-world enterprise AI failures and the 2026 incident trackers both converge on the same finding: excessive agent permissions are the most predictable failure mode in agentic security, and they are predictable precisely because nobody scopes permissions at deployment time. Agents get provisioned with whatever the integrating human had, because that is the path of least resistance during a build.

What Step Finance demonstrates is the permission inheritance problem in its purest form. Security teams spend enormous effort on identity: who is this human, are they who they claim, have they authenticated strongly. Then an agent is deployed that acts on behalf of that identity, holds its authority continuously, and is never asked to re-authenticate. Every control you built around the human now protects a door the agent has already walked through and propped open.

HiddenLayer's 2026 reporting found autonomous agents now account for more than one in eight reported AI breaches across enterprises, and only 21% of executives claim complete visibility into agent permissions and data access patterns. That second number is the one that should alarm people. Four out of five organizations running agents cannot enumerate what their agents are allowed to do.

The DeFi context makes the loss fast and irreversible, but nothing about the mechanism is crypto-specific. Substitute an ERP, a payment rail, a cloud account, or a customer database for the treasury. The chain is identical: compromise a human endpoint, inherit a standing agent authority, execute at machine speed through a path that was designed to have no human in it.

How It Could Have Been Prevented

• Replace standing authority with per-transaction, expiring authorization. An agent should receive authority to execute this rebalance, for this amount, valid for this window — not a permanent grant to move treasury balances. Authority that expires cannot be inherited by whoever compromises the endpoint next month.

• Tier permissions by blast radius, not by task type. Routine rebalancing below a threshold can be fully autonomous. Movements above it require an approval the agent structurally cannot produce — a second human, on a second device, through a channel the agent does not control. The threshold is a business decision; the existence of a threshold is not optional.

• Rate-limit and velocity-check at the agent layer. 261,000 SOL in a single session is not a normal rebalance pattern, and the system should have known that. Caps on cumulative value moved per hour, per day, and per session convert a total loss into a bounded one, even when every individual transaction looks legitimate.

• Treat agent control planes as crown-jewel infrastructure. Access to the systems that instruct agents deserves the hardening you give production database access: dedicated hardware, phishing-resistant MFA, session recording, and no path from a general-purpose executive laptop. The endpoints here were compromised with commodity malware.

• Alert on agent actions, not just on agent errors. Most agent observability watches for failures — timeouts, exceptions, low-confidence outputs. This agent never errored. It succeeded, repeatedly, at large scale. Monitoring has to cover successful high-value actions or it will watch the treasury leave without raising anything.

• Require out-of-band confirmation for irreversible operations. On-chain transfers, like terraform destroy and volume deletions, have no undo. Anything with no undo needs a gate the agent cannot satisfy by itself. This is the control Supervaizer exists to enforce.

The Lesson

The most uncomfortable part of the Step Finance story is that nothing malfunctioned.

The agents were not tricked. They did not hallucinate a transfer. They did not misread a prompt or take a creative interpretation of an ambiguous instruction. They received instructions through a legitimate channel, from a session that presented valid authority, and they executed those instructions correctly and efficiently. Every component performed to specification.

That is what makes it a governance failure rather than a technical one. The organization had made a decision — implicitly, probably without ever writing it down — that moving eight figures of treasury value should require no human confirmation, because requiring one would have made the automation less useful. That decision was invisible until an attacker found it.

Every agent deployment encodes decisions like this. When you grant an agent a permission, you are not just deciding what the agent may do when it is working correctly on your behalf. You are deciding what anyone who reaches that agent may do. The permission is the security boundary; the agent is just the thing standing on top of it.

Step Finance recovered $4.7 million of $27 million and closed twenty-four days later. The agents are still, technically, blameless.

Pull the permission list for every agent you run against a financial system. For each one, ask: if an attacker were sitting in an authorized operator's session right now, what is the largest irreversible action this agent would perform for them without asking anyone? That number is your actual exposure — not your MFA coverage, not your endpoint tooling. That number.

Sources

• CoinDesk — "Solana-based DeFi platform Step Finance hit by $30 million treasury hack as token price craters," January 31, 2026
• CoinDesk — "Step Finance shuts operations after $27 million January hack," February 24, 2026
• Cointelegraph — "Step Finance Treasury Breach Sparks $27M SOL Loss, STEP Plunges," 2026
• Halborn — "Explained: The Step Finance Hack (January 2026)"
• Beam AI — "5 Real AI Agent Security Breaches in 2026 and Their Lessons"