YieldBlox Stellar Oracle Manipulation Exploit (Feb 2026)

2025-02-24

Blend V2 Code4rena competitive audit with Certora Formal Verification launched, with a $125,000 USDC prize pool. Reported as the first Rust/Soroban formal verification contest in DeFi.

2026-02-14

Attacker's primary Stellar reconnaissance wallet created, seeded with 56.32 XLM, eight days before the exploit.

2026-02-21

At 23:35 UTC, attacker creates SDEX manipulation burner account (GCNF5GNRIT6VWYZ7LXUZ33Q3SR2NUGO32F5X65VVKAEWWIQCKGYN75HB) with 15 XLM. At 23:38 UTC, attacker places inflated sell offer for USTRY at 107 USDC per USTRY, approximately 100-fold fair value.

2026-02-22

At 00:10:21 UTC, second attacker-controlled account executes price-setting trade of 0.05 USTRY at approximately $106.7, dominating the Reflector VWAP pricing window. At 00:24-00:25 UTC, attacker deposits USTRY collateral and borrows 1,000,196.70 USDC and 61,249,278.31 XLM, draining the entire pool of approximately $10.97 million.

2026-02-22

Stellar Tier-1 validators coordinate to freeze approximately 48 million XLM (approximately $7.2-7.5 million) in attacker Stellar accounts before bridging can complete.

2026-02-22

Script3 issues public statement on X confirming exploit is isolated to a single pool, that no other Blend pools are affected, and commits to full depositor compensation for USDC, XLM, and EURC losses.

2026-02-22

YieldBlox Security Council sends on-chain bounty message offering 10% white-hat incentive with 72-hour deadline in exchange for return of frozen funds and cessation of legal pursuit.

2026-02-23

Attacker consolidates approximately 380 ETH and bridges funds cross-chain between 09:17 and 09:26 UTC. Attacker does not respond to bounty offer before 72-hour deadline.

2026-02-27

Attacker moves 100 ETH to Tornado Cash (tx 0xdc082828a2358ccb33b3837b49bfe678c31259aad59c39c76916a53f8c73853b), signaling intent to launder rather than return funds.