The YieldBlox $10M Oracle Poisoning: How One Trade in a Dead Market Drained an Entire Lending Pool — And the 5-Defense Pattern Every Protocol Needs

On February 22, 2026, a single trade worth barely $5 on the Stellar DEX inflated a token's price by 100×, allowing an attacker to borrow $10.97 million against worthless collateral. The YieldBlox exploit wasn't a smart contract bug — it was an economic attack that every DeFi protocol using on-chain oracles must study. The Setup: A Perfect Storm of Illiquidity YieldBlox operated as a Blend V2 lending pool on Stellar, accepting USTRY (a U.S. Treasury-backed token worth ~$1.05) as collateral. It sourced prices from Reflector, a volume-weighted average price (VWAP) oracle that sampled trades on the Stellar Decentralized Exchange (SDEX). Here's the problem: the USTRY/USDC market on SDEX was essentially dead. Less than $1 in hourly volume. Virtually no order book depth. And just before the attack, the sole market maker had withdrawn all liquidity. The Reflector oracle was designed correctly — it faithfully reported volume-weighted prices from the market. But a VWAP oracle in a market with ze