YieldBlox lending pool loses about US$10.2 million through manipulated collateral prices
An attacker drained YieldBlox’s Stellar lending pool using inflated collateral prices. About US$7.2 million was frozen, but repayment is unconfirmed. Affected depositors should seek recovery updates through established YieldBlox or Script3 channels.
If you deposited in YieldBlox, check your position and seek recovery information through the YieldBlox or Script3 channels you already use. Nothing needs updating on your devices; people who did not use this pool have no incident-specific action to take.
What’s happening
On 22 February 2026, an attacker drained YieldBlox’s community-managed lending pool on Stellar by inflating the price of USTRY, an asset accepted as loan collateral. The pool’s price feed relied on a thinly traded market, allowing the attacker to borrow far more than the collateral was worth. BlockSec identified a pool configuration failure rather than a flaw in Blend V2’s core contracts. The theft affected people with money in that pool. Validators subsequently quarantined about 48 million XLM, initially valued at roughly US$7.2 million, and the pool was placed on ice. A May proposal sought to formalise the account freeze. As at 3 November, the reviewed sources do not confirm depositor repayment, completed recovery or a safe restart.
- What
- Breach
- Affects
- YieldBlox DAO lending pool on Stellar (Blend V2)
- Fixed in
- Nothing to patch
- Since
- 22 Feb 2026
- Closed
- 7 May 2026
Timeline
- Update
Stellar proposal SLP-0006 described the pool as having been placed on ice and about 48 million XLM as quarantined. It proposed moving the existing validator block on three attacker-linked accounts into network configuration; the published proposal remains marked Draft.
- Update
Halborn reported that the attacker had ignored the bounty offer’s 72-hour deadline. Its analysis also described additional losses from liquidations triggered by the manipulated price.
- Update
Cryip reported that Stellar validators had frozen approximately 48 million stolen XLM, then worth US$7.2–7.5 million. The YieldBlox Security Council offered the attacker 10% if the remaining funds were returned.
- UpdateNothing to patch
An attacker manipulated USTRY collateral prices and drained approximately 61.25 million XLM and 1 million USDC from YieldBlox’s lending pool. Halborn valued the theft at about US$10.2 million.
Sources
- SLP-0006: Freeze YieldBlox Exploit Stellar AccountsStellar · 7 May 2026
- YieldBlox DAO Incident on Stellar: Oracle Misconfiguration Enabled a $10M+ DrainBlockSec · 26 Feb 2026
- Explained: The YieldBlox Hack (February 2026)Halborn · 26 Feb 2026
- Blend Protocol Exploit: $10.8M Stolen from Stellar’s YieldBlox Pool via Oracle ManipulationCryip · 24 Feb 2026