Breaches and incidentsBriefChecked against a primary source
YieldBlox DAO pool on Blend (Stellar): oracle read a manipulable DEX price
22 Feb 2026 UTC: more than USD 10M lost (1M USDC and 61.2M XLM borrowed).
- Disclosed
What happened
- Root cause per BlockSec: a configuration issue, “not a Blend V2 core-contract issue”. The pool used Reflector, which priced USTRY from a thin Stellar DEX market. The attacker pushed USTRY from about USD 1.06 to about USD 107 and borrowed against it.
- Attribution: none.
- Response: Halborn reports USD 7.2M frozen by Stellar Tier-1 validators. A 10% bounty was offered.
Sources
- https://blocksec.com/blog/yieldblox-dao-incident-on-stellar-oracle-misconfiguration-enabled-a-10m-drain
- https://www.halborn.com/blog/post/explained-the-yieldblox-hack-february-2026
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.