Social Engineering Breaches Hit Figure Technology and Step Finance

• Figure Tech breached after an employee fell for a scam; ShinyHunters leaked 2.5GB of sensitive data.

• Step Finance lost $29M in SOL after hackers accessed treasury wallets, cause remains unclear.

• Social engineering and AI scams are rising, threatening both tech firms and crypto platforms alike.

A growing wave of cyberattacks has shaken the tech and crypto sectors, highlighting the risks of human-targeted exploits. Recently, Figure Technology disclosed a breach after an employee fell for a social engineering scam, allowing hackers to access a few files.

The company confirmed that it had notified the affected partners and provided them with free credit monitoring services. Moreover, the reporters highlighted that the spokesperson of Figure did not respond to several specific questions regarding the breach. The black-hat hacking group ShinyHunters took responsibility for the breach on their dark web platform, claiming that the company failed to satisfy their demands, leading to the leakage of 2.5 GB data.

In addition, Figure explained, “We also recently discovered that an individual was tricked into handing over their login credentials, which allowed a user to download a few files using their account. We immediately acted to put a stop to it and retained a forensic firm to help determine which files were compromised.” As a result, it was determined that the attack was a social engineering attack, which relies on psychological manipulation to obtain unauthorized access.

Recently, Chainalysis reported that scammers have managed to steal a staggering $17 billion in cryptocurrency within the last year using AI to enhance impersonation and social engineering attacks. This is in line with the industry concern that arose after a report by Privacy Rights Clearinghouse in December 2025, which indicated that regulators have filed over 8,000 filings that affect at least 374 million people.

Broader Implications for Tech and Crypto

Anonymous sources revealed that Figure’s breach might be part of a larger campaign targeting companies using Okta’s single sign-on service. Other alleged victims include the University of Pennsylvania and Harvard University.

Meanwhile, Step Finance, a major DeFi platform on Solana, confirmed a breach affecting several treasury and fee wallets. Onchain data shows hackers unstaked about 261,854 SOL, moving funds to unknown addresses. At a price of $110 per SOL, these transfers total nearly $29 million.

Step Finance posted on X, “We experienced a security breach in some of our treasury wallets a few hours ago, and we are currently looking into it… We will share more details later.” However, the company did not specify the breach’s root cause, sparking speculation over smart contract flaws or access control issues.

Consequently, the community questioned whether user funds outside treasury wallets faced risk. Despite repeated media inquiries, Step Finance declined to provide further comment.