CometDEX (BLND-USDC pool) hack — August 2026
Incident facts
| Date of incident | |
|---|---|
| Target type | Decentralised exchange |
| Loss | $717,519Price at time of incident |
| Method | Contract logic errorThe pool accepted a swap of an asset for itself, USDC for USDC, which corrupted its reserve accounting and could be repeated for profit |
| Chains | Other |
| Outcome | Unresolved |
What happened
The BLND-USDC liquidity pool of CometDEX, the Comet automated market maker on Stellar, was drained of about $717,518.92 in USDC on 25 August 2026. The bug was an accounting one: the pool allowed a swap where the input and output asset were the same, USDC for USDC, which left its reserve figures wrong in the attacker's favour. Funded by flash loans from a Blend pool, the attacker repeated the sequence roughly thirty-six times.
The pool matters beyond its own size because it serves as the backstop for Blend, Stellar's largest lending protocol. Blend said its own contracts were not affected and that funds deposited in Blend pools were not at risk, but its operators paused the backstop, and Blend's total value locked fell from more than $150m to close to nothing. Stellar's DeFi sector as a whole went from a peak of about $270m on 22 August to roughly $98m by 27 August.
That collapse in total value locked is not what this entry records. The $717,519 is the USDC extracted from the pool; the ecosystem-wide fall is depositors withdrawing from a protocol they no longer trusted, which is a market reacting rather than money being taken.
This is a separate incident from the February 2026 oracle manipulation of the YieldBlox pool on Blend V2, also on Stellar, which is recorded elsewhere in this registry.
Sources
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "CometDEX (BLND-USDC pool) hack — August 2026", iTokenly, accessed 2026-09-01, https://itokenly.com/hacks/cometdex-blnd-usdc-poolhttps://itokenly.com/hacks/cometdex-blnd-usdc-poolPermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.