{"id":"yieldblox-collateral-price-theft-feb-2026","category":"breach","status":"closed","title":"YieldBlox lending pool loses about US$10.2 million through manipulated collateral prices","tldr":"An attacker drained YieldBlox’s Stellar lending pool using inflated collateral prices. About US$7.2 million was frozen, but repayment is unconfirmed. Affected depositors should seek recovery updates through established YieldBlox or Script3 channels.","summary":"On 22 February 2026, an attacker drained YieldBlox’s community-managed lending pool on Stellar by inflating the price of USTRY, an asset accepted as loan collateral. The pool’s price feed relied on a thinly traded market, allowing the attacker to borrow far more than the collateral was worth. BlockSec identified a pool configuration failure rather than a flaw in Blend V2’s core contracts. The theft affected people with money in that pool. Validators subsequently quarantined about 48 million XLM, initially valued at roughly US$7.2 million, and the pool was placed on ice. A May proposal sought to formalise the account freeze. As at 3 November, the reviewed sources do not confirm depositor repayment, completed recovery or a safe restart.","action":"If you deposited in YieldBlox, check your position and seek recovery information through the YieldBlox or Script3 channels you already use. Nothing needs updating on your devices; people who did not use this pool have no incident-specific action to take.","product":"YieldBlox DAO lending pool on Stellar (Blend V2)","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["yieldblox","stellar","blend","crypto-theft","price-manipulation"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"SLP-0006: Freeze YieldBlox Exploit Stellar Accounts","url":"https://github.com/stellar/stellar-protocol/blob/master/limits/slp-0006.md","by":"Stellar","date":"2026-05-07"},{"kind":"research","title":"YieldBlox DAO Incident on Stellar: Oracle Misconfiguration Enabled a $10M+ Drain","url":"https://blocksec.com/blog/yieldblox-dao-incident-on-stellar-oracle-misconfiguration-enabled-a-10m-drain","by":"BlockSec","date":"2026-02-26"},{"kind":"research","title":"Explained: The YieldBlox Hack (February 2026)","url":"https://www.halborn.com/blog/post/explained-the-yieldblox-hack-february-2026","by":"Halborn","date":"2026-02-26"},{"kind":"news","title":"Blend Protocol Exploit: $10.8M Stolen from Stellar’s YieldBlox Pool via Oracle Manipulation","url":"https://cryip.co/blend-protocol-exploit-10-8m-stolen-from-stellars-yieldblox-pool-via-oracle-manipulation/","by":"Cryip","date":"2026-02-24"}],"started":"2026-02-22","closed":"2026-05-07","created":"2026-11-03T21:42:51.534Z","updated":"2026-11-03T21:42:51.534Z","cve_notes":[],"timeline":[{"at":"2026-05-07","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Stellar proposal SLP-0006 described the pool as having been placed on ice and about 48 million XLM as quarantined. It proposed moving the existing validator block on three attacker-linked accounts into network configuration; the published proposal remains marked Draft.","url":"https://github.com/stellar/stellar-protocol/blob/master/limits/slp-0006.md","by":"Stellar","patch":null},{"at":"2026-02-26","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Halborn reported that the attacker had ignored the bounty offer’s 72-hour deadline. Its analysis also described additional losses from liquidations triggered by the manipulated price.","url":"https://www.halborn.com/blog/post/explained-the-yieldblox-hack-february-2026","by":"Halborn","patch":null},{"at":"2026-02-24","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Cryip reported that Stellar validators had frozen approximately 48 million stolen XLM, then worth US$7.2–7.5 million. The YieldBlox Security Council offered the attacker 10% if the remaining funds were returned.","url":"https://cryip.co/blend-protocol-exploit-10-8m-stolen-from-stellars-yieldblox-pool-via-oracle-manipulation/","by":"Cryip","patch":null},{"at":"2026-02-22","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"An attacker manipulated USTRY collateral prices and drained approximately 61.25 million XLM and 1 million USDC from YieldBlox’s lending pool. Halborn valued the theft at about US$10.2 million.","url":"https://www.halborn.com/blog/post/explained-the-yieldblox-hack-february-2026","by":"Halborn","patch":"na"}],"url":"https://hard.fyi/live/yieldblox-collateral-price-theft-feb-2026/","json":"https://hard.fyi/api/live?id=yieldblox-collateral-price-theft-feb-2026"}