Breaches and incidents
YieldBlox DAO pool on Blend (Stellar): oracle read a manipulable DEX price
22 Feb 2026 UTC: more than USD 10M lost (1M USDC and 61.2M XLM borrowed).
- Disclosed
- Verification
- Checked against a primary source
What happened
- 22 Feb 2026 UTC: more than USD 10M lost (1M USDC and 61.2M XLM borrowed).
- Root cause per BlockSec: a configuration issue, “not a Blend V2 core-contract issue”. The pool used Reflector, which priced USTRY from a thin Stellar DEX market. The attacker pushed USTRY from about USD 1.06 to about USD 107 and borrowed against it.
- Attribution: none.
- Response: Halborn reports USD 7.2M frozen by Stellar Tier-1 validators. A 10% bounty was offered.