YieldBlox hack — February 2026

The YieldBlox DAO lending pool, a community-managed deployment of the Blend V2 protocol on Stellar, was drained on 22 February 2026 through price oracle manipulation.

The pool valued USTRY, a tokenised Treasury asset, using the Reflector oracle, which computes a volume-weighted average price from trades on the Stellar decentralised exchange. That USTRY/USDC market was extremely thin — under $1 of hourly trading volume — after a market maker pulled its liquidity. The attacker cleared the standing orders and executed a single small trade at an inflated price, pushing the recorded USTRY price from about $1.05 to roughly $106.73. Because that trade was the only one inside the 300-second aggregation window it dominated the average, and the deviation check on Blend's oracle wrapper compared each new price only to the immediately preceding window, so two consecutive manipulated windows both passed. The attacker posted USTRY as collateral and borrowed 1,000,196.70 USDC and 61,249,278.31 XLM.

Most published loss figures cluster at $10 million to $10.2 million. A higher figure of about $10.97 million circulates but could not be traced to a citable statement. At the day's XLM spot rate of about $0.161 the borrowed XLM and USDC total roughly $10.9 million. Proceeds were bridged to BNB Chain, Base and Ethereum.

Stellar tier-1 validators coordinated to reject transactions from the attacker's accounts, quarantining about 48,069,094 XLM — roughly 73 percent of the borrowed XLM, put at $7.2 million to $7.3 million. The protocol offered a 10 percent bounty with a 72-hour deadline, which the attacker ignored. Script3, the developer behind YieldBlox, said all EURC, USDC and XLM depositors in the affected pool would be fully compensated for bad debt. The Blend V2 core contracts were not at fault — the pool was misconfigured by its operator.