Get the Crypto Payment Security & Compliance Playbook
Back to Blog

YieldBlox DAO Incident on Stellar: Oracle Misconfiguration Enabled a $10M+ Drain

Code Auditing
February 26, 2026
3 min read

On February 22, 2026, a lending pool operated by YieldBlox DAO on Stellar's Blend V2 was exploited, resulting in losses exceeding $10 million.

The attacker manipulated the USTRY/USDC market on SDEX. The pool's configured Reflector oracle path then accepted the manipulated price, overvalued USTRY collateral, and enabled the attacker to drain pool assets (USDC and XLM).

This incident was not a Blend V2 core-contract issue. It was a pool-operator (YieldBlox DAO) configuration issue.

2. Background

On Stellar, Blend V2 is a liquidity protocol that allows users to create isolated lending pools. Each pool defines its own borrow assets, collateral assets, and oracle settings.

In this incident, the affected pool allowed users to borrow XLM and USDC using USTRY as collateral. The pool used the Reflector oracle [2], and USTRY pricing was sourced from the USTRY/USDC market on SDEX [3], with periodic updates.

3. Vulnerability Analysis (Root Cause Analysis)

The exploit was enabled by a pool-side pricing design that relied on a manipulable market.

  1. The USTRY/USDC market on SDEX was very shallow.
  2. The attacker could clear normal orders and place abnormal orders to push the apparent market price sharply higher.
  3. Reflector then updated USTRY to the manipulated value.
  4. The pool's risk logic accepted that value for collateral valuation, which inflated borrow power.

As a result, the attacker used overvalued USTRY collateral to drain borrowable assets from the pool.

4. Attack Analysis

  1. (Tx 1, 2) The attacker manipulated USTRY on SDEX from about $1.06 to about $107 by consuming normal liquidity and placing abnormal orders.
  1. (Tx 3) Reflector pulled the manipulated SDEX price and updated its feed.
  1. (Tx 4, 5) The attacker borrowed 1,000,196e7 USDC with 12,881e7 USTRY collateral.
  1. (Tx 6, 7) The attacker borrowed 6,124,927,810e7 XLM with 14,987,610e7 USTRY collateral.
  1. (Tx 8, 9, 10) The attacker bridged drained assets to Base, BSC, and Ethereum.

5. Loss/Profit Analysis

Estimated total loss was about $10M+ on Stellar.

ID Chain Action Loss Tx(s) Hash
1 Stellar Price Manipulation - 09e1a9d1197c9bf0af4e87da328c4f2d5eb49b487630aa61991fb5c1c4637cdb
2 Stellar Price Manipulation - 60fe039e96e88402d175c8de68e80651874ab125880dd384a1636914ba95bef1
3 Stellar Price Update - 56466ad66cd5c49a251b9f1c7c0cf6b1b2f62d121b58ff856e2b43673b22be51
4 Stellar Supply 1 - b810ba4a8d7547bb024f17b58c32cc644533176206d0f8178d4ba0a545cb7597
5 Stellar Borrow 1 $1M (1M USDC) ae721cacee382bdecac8d2c47286ecd42cb4711f658bb2aec7cba60dc64a31ff
6 Stellar Supply 2 - 81f304ae627ba294df0f9c0708a58a2fe770b39d65f8cd0efe1d7d6d6cc885a6
7 Stellar Borrow 2 $9.85M (61.2M XLM) 3e81a3f7b6e17cc22d0a1f33e9dcf90e5664b125b9e61f108b8d2f082f2d4657
8 Stellar Bridge to Binance Smart Chain - 1210ccb583c174e0ecb3cdc56adbc59a06d73b7ebcb07b7e9a1c0c371b9f00e3
9 Stellar Bridge to Base - first: 3fba5c384763349b74c7bfece148eb12600b161faf3382ba9c1f5f0fe76d52f5, last: df6129cce16edc7800a4199edb9d2ef2f3e6bfc9d3f44d6e29b3ab20c8dc1714 (15 total)
10 Stellar Bridge to Ethereum - first: 4012e2d140ea493de8d8abe5cc2ddd9e7d7f6661594d53fef5d0cfc26e1c7f0b, last: f383fedb28dae42a6d8d8aab77de81d0645c67e57d3f6bc10683f659d229cce6 (16 total)
Chain Type Address
Stellar Attacker GBO7VUL2TOKPWFAWKATIW7K3QYA7WQ63VDY5CAE6AFUUX6BHZBOC2WXC
Stellar Attacker GCNF5GNRIT6VWYZ7LXUZ33Q3SR2NUGO32F5X65VVKAEWWIQCKGYN75HB
Stellar Attacker GDHRCQNC64UVL27EXSC6OG6I2FCT4NWM72KNHLHKEB3LK4MEEYYWETN3
Stellar Attacker GATDQL767ZM2JQTBEG4BQ5WKOQNGAGWZDUN4GYT2UINPEU3RT2UAMVZH
Stellar Reflector Oracle CALI2BYU2JE6WVRUFYTS6MSBNEHGJ35P4AVCZYF3B6QOE3QKOB2PLE6M
Stellar Victim Pool CCCCIQSDILITHMM7PBSLVDT5MISSY7R26MNZXCX4H7J5JQ5FPIYOGYFS
BSC, Base, Ethereum Attacker 0x2d1ce29b4af15fb6e76ba9995bbe1421e8546482
Ethereum Attacker 0x0b2b16e1a9e2e9b15027ae46fa5ec547f5ef3ec6
Ethereum Attacker 0xe69f6d77db6ff493fdd15d8a0b390c36e18e5b21

6. Conclusion

The core issue is straightforward: collateral valuation in this pool depended on a manipulable price source. This was a pool-operator (YieldBlox DAO) configuration failure, not a Blend V2 core-contract flaw. This incident is a reminder that lending pools must select and monitor price dependencies with strong manipulation resistance.

References

[1] YieldBlox DAO

[2] https://reflector.network/

[3] USTRY/USDC Market on the SDEX

About BlockSec

BlockSec is a full-stack blockchain security and crypto compliance provider. We build products and services that help customers to perform code audit (including smart contracts, blockchain and wallets), intercept attacks in real time, analyze incidents, trace illicit funds, and meet AML/CFT obligations, across the full lifecycle of protocols and platforms.

BlockSec has published multiple blockchain security papers in prestigious conferences, reported several zero-day attacks of DeFi applications, blocked multiple hacks to rescue more than 20 million dollars, and secured billions of cryptocurrencies.

Sign up for the latest updates
Bitget's $387.5M Off-Chain Breach: Beyond Keys and Contracts
Security Insights

Bitget's $387.5M Off-Chain Breach: Beyond Keys and Contracts

On September 24, 2026, attackers exploited a vulnerability in a third-party security product, obtained internal credentials, and forged withdrawal commands. The resulting transfers moved approximately $387.5M from some of Bitget's operational wallets across Ethereum, other EVM networks, XRP Ledger, Zcash, and TRON; private keys and cold wallets remained intact. This deep dive summarizes the disclosed incident path and fund flow, examines rapid conversion into native assets and the ecosystem recovery response, proposes a systematic defense-in-depth framework for institutions, and explains how authorized blockchain penetration testing can validate cross-layer assumptions.

~$11.3M Lost: Multicall Router, Nostra | BlockSec Weekly
Security Insights

~$11.3M Lost: Multicall Router, Nostra | BlockSec Weekly

This report, covering 2026/09/14 - 2026/09/20, examines two security incidents with approximately $11.3M in combined losses, on Ethereum and Starknet. In the larger one, a multicall router accepted its own address as a dispatch target, so the nested call reached the Gateway module of a Safe wallet carrying the router's own already-authorized identity instead of the external caller's, and roughly 2,900 `aEthrsETH` was routed out of that wallet into an attacker-created Uniswap v4 pool. On Starknet, Nostra's oracle integration required a minimum of only one aggregated source, so when only two of the three configured price sources reached the aggregation, a manipulated thin-pool quote averaged with a normal quote to value `NSTR` at roughly $49.52, supporting approximately $3.5M of borrowing against overvalued collateral.

~$320M Lost: Liquid Network, Symbiosis Exploits | BlockSec
Security Insights

~$320M Lost: Liquid Network, Symbiosis Exploits | BlockSec

This report, covering 2026/09/07 - 2026/09/13, examines two security incidents that caused approximately $320M in losses, including the Liquid Network exploit of 2026/09/06 that the previous report did not cover. The larger was that Liquid Network exploit, where the rangeproof validation cache in Elements derived its key by hashing four fields — two of them variable in length — concatenated with nothing marking the boundaries between them, so a verdict recorded for one output was returned for another whose proof was never examined, letting the attacker create 4,000 unbacked L-BTC and peg out nearly all of them as bitcoin. On the Bitcoin route of the Symbiosis cross-chain bridge, spanning BNB Smart Chain, Ethereum and Rootstock, off-chain code that reads Bitcoin deposits took the depositor's identity from a field the depositor controls and then subtracted its fee from the deposit without checking whether the fee itself was negative, letting a 330-satoshi deposit mint `46,116,860,184.27388234 syBTC`; the pools it had to be sold through held only 11.26 syBTC, so the loss to liquidity providers and users came to an estimated 9.97 BTC (~$770K).

Best Security Auditor for Web3

Validate design, code, and business logic before launch. Aligned with the highest industry security standards.

BlockSec Audit