What happened
A February 2026 incident drained a YieldBlox DAO lending pool operating on Stellar's Blend V2 protocol. The available technical analyses attribute the loss to a thin-market price feeding the pool's oracle configuration, not to a reported core Blend protocol bug. Estimates range from about $10.2 million to $10.86 million.
An oracle configuration accepted a manipulable price from a thin-liquidity market for collateral valuation. Lending pools need liquidity-aware price-source selection, bounds on price movement, collateral limits, and a safe response when market depth is insufficient.
Case & protocol details
Attack Timeline
The affected pool accepted USTRY as collateral and relied on a Reflector oracle configuration that incorporated price data from Stellar's decentralized exchange. Researchers reported that USTRY liquidity was thin enough for an attacker to move its quoted price materially. Once the oracle treated the inflated quote as collateral value, the attacker could borrow high-value assets against collateral whose real market value was far lower.
Public proof-of-concept analysis describes the drain as including USDC and XLM. This distinction matters: the incident was specific to the YieldBlox DAO pool's asset and oracle configuration, rather than evidence that every Blend V2 pool shared the same flaw.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report x.com
- report Report x.com
- code Code reference github.com
- analysis BlockSec: YieldBlox DAO incident on Stellar blocksec.com
- analysis Halborn: YieldBlox hack explained halborn.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.