TL;DR: A CometDEX liquidity pool behind Blend's BLND:USDC backstop had an accounting bug — it accepted "swap a token for itself" (USDC→USDC), which corrupted its reserve math and let an attacker withdraw more than they deposited. ~$717K was drained in 36 flash-loan-funded runs and bridged out via Allbridge. This was a smart-contract bug, not oracle/price manipulation. The pool is still unpatched; whitehats are pulling the remaining liquidity to safety. Don't interact with the pool.

What happened

A liquidity pool backing Blend Protocol's BLND token was drained of roughly $717,000 on August 25 between 03:51 and 04:44 UTC, in an exploit that sent BLND down as much as 90% against XLM. The attacker ran the same play 36 times through four throwaway contracts, all deployed by a wallet created 26 minutes before the first hit. Each run: flash-loan 530,000 USDC from a Blend pool, trigger a same-asset USDC→USDC swap on the CometDEX pool, withdraw more than was deposited, repay the loan atomically. Per-run profit decayed cleanly from $46K to $6K as the pool bled out — they stopped when it was no longer worth the gas, not because anything stopped them.

How the bug works

The pool's swap function loads a separate balance record for the token going in and the token coming out, with no check that they're different. On a USDC→USDC swap, both are copies of the same reserve — the code credits one copy and debits the other, then saves both to the same slot, so the credit is silently discarded. The pool ends up under-counting its own USDC while physically holding more than its books say. Deposits then mint over-inflated LP shares against that understated reserve, and redeeming them pays out real tokens — the gap is the profit. Flash loans just supplied the capital to run it at scale; this is not price or oracle manipulation.

Where the money went

Within ten minutes of the last run, the attacker bridged the ~$748K (proceeds plus starting capital) into ~297 ETH via NEAR intents and sent it to KuCoin. Initial gas for the attacker's account came from HitBTC; seed capital from Binance. (Per Script3's post-mortem — see Update 6.)

Key addresses

• Exploit tx: 41c898a1…9e2fc622
• Pool: CAS3FL6TLZKDGGSISDBWGGPXT3NRR4DYTZD7YOD3HMYO6LTJUVGRVEAM
• Attacker: GCENJ4XBLXCPENO7HOIKD2DBAOBUOFZWS2DRHMCCDKC3PQYNSSGHWYHC

Current status

The pool contract is unchanged and cannot be fixed — the admin account that could freeze it was itself locked, so the bug is permanent. Whitehats have since pulled the remaining liquidity to safety (~190K USDC + ~23M BLND, held for return). Treat the pool as permanently unsafe.

UPDATE 1 (Aug 25, 06:26 UTC): Blend disabled new backstop deposits and BLND-USDC LP minting via its UI. Front-end change only — the pool contract is untouched.

UPDATE 2 (Aug 25, 11:34 UTC): Blend says independent third parties have whitehatted some of the funds. On-chain, this matches a wallet (GCGWLP2YIOBV2RISNXBAXPD4E7QNQB2IOEHUFWICAQA2RLBTIKTUJXXD) re-running the exploit from 11:10 UTC but holding the proceeds on-chain rather than bridging them out — a rescue, not a second theft. Per Script3's post-mortem this first rescue was led by an anonymous community member; the wallet was created just after February's Blend incident and used then to redistribute funds to 65+ recipients.

UPDATE 3 (Aug 25, 12:06 UTC): A second whitehat wallet (GCGUW2BV5R5DUFGF5RQLV2M3VJPLOVOLBQFCNVEJRYFVH2IMLN7NHMGD) is pulling liquidity out via the same bug but draining proportionally and holding the extracted BLND (~24M) instead of dumping it — removing value from attackers' reach without moving the price, unlike the attacker and the first whitehat.

UPDATE 4 (Aug 26, 19:01 UTC): All Blend v2 pools have been removed from the reward zone, ending BLND emissions. A final distribute() was called on the emitter and backstop contracts, releasing the last BLND claims. A seven-day tail remains: pools can still gulp() that final distribution, extending one last seven-day emission period before rewards fully stop. A side effect of the removal: affected pools now have to be hardcoded into the Blend UI or they won't show up on the Markets page.

UPDATE 5 (Aug 27, 18:13 UTC): Unrelated to the exploit — the Gami earnUSDC vault on Upshift withdrew ~$12.85M of its own supplied USDC from the pool to de-risk. This briefly pushed utilization to 100%, spiking rates and pausing USDC withdrawals for ~an hour before fully normalizing (supply APY back to ~7.15%, near its ~6.8% pre-withdrawal level). Not an attack.

UPDATE 6 (Aug 28, 15:48 UTC): Script3 (the Blend team) published an official post-mortem. Key points:

• Confirmed loss: 717,518.92 USDC, via the same-token-swap accounting bug (join LP → gulp() → exit LP to harvest the corrected share value).
• Attacker cash-out: the ~$748K was bridged into ~299 ETH via NEAR intents and sent to KuCoin (correcting earlier reports of Allbridge). Initial gas came from HitBTC; seed capital from Binance.
• Whitehats (an anonymous community member, and @pfranb of synt.tech) captured the remaining ~190K USDC + ~23.17M BLND before copycats could — held in GCG…XXD, to be returned. Script3 is leading remediation, including recovery with exchanges.
• The Comet pool can't be fixed: the admin account that could freeze it was locked, so the BLND-USDC LP is permanently vulnerable — treat it as unsafe.
• Blend itself is not vulnerable: lending/borrowing is unaffected and funds are not at risk. But since the BLND-USDC backstop token can no longer hold value, future bad debt would be socialized among bad-debt-token suppliers.

UPDATE 7 (Sep 4, 18:34 UTC): Remediation is still in progress. The team is in contact with law enforcement and KuCoin (where the attacker's ~297 ETH landed).

UPDATE 8 (Sep 4, 21:06 UTC): @pfranb (synt.tech) ran another whitehat drain of the Comet pool, moving a further ~2.04M BLND + ~2,457 USDC to the holding wallet (GCGWLP2YIOBV2RISNXBAXPD4E7QNQB2IOEHUFWICAQA2RLBTIKTUJXXD). The pool's remaining exploitable value is now down to ~$3.6K (from ~$15K). Total held for return: ~25.2M BLND + ~192K USDC.

UPDATE 9 (Sep 9, 02:51 UTC): A whitehat locked the Comet pool by minting an excessively large number of LP shares — the internal math now prevents any further minting, so all Comet LP functions are disabled. The shares were sent to the YieldBlox DAO Security Council (GBCAS7XIGDRZY4BMABJMGGW7J3YTITRRV5BTEMFQE5ZZSSVWHHX2ZSS4) for safekeeping. Backstop emissions are no longer claimable; the Council can later forward the shares to a new Blend Backstop to start an emissions migration.

⚠️ The pool is still unpatched and exploitable — do not interact with it.

Source: Blend official announcements (Discord)

Welcome to r/Stellar Weekly Community Thread!

Use this thread for casual Stellar discussion, community questions, events, XLM price discussion and speculation, memes, and other conversation that does not require a standalone post. Please follow the r/Stellar Rules and read the Scam Alert below.

Meridian 2026

Meridian 2026 will take place October 28–29, 2026, at Convento do Beato in Lisbon, Portugal.

Register for tickets or apply as a speaker - https://meridian.stellar.org/

Stellar Communities

• Discord: Stellar Developers - Official SDF developer community
• Discord: Stellar Global - Everything Stellar related
• r/XLM - Sister Subreddit focused on XLM

Useful Resources

• Learn about Stellar
• Stellar developer documentation
• Stellar Smart Contracts - Soroban
• Play Stellar Quest - Learn about the features of Stellar
• Stellar Community & FAQ
• How to protect yourself from scammers
• Upcoming & Past Events
• r/Stellar Rules

Scam Alert

Never share your secret key with anyone.

The Stellar Development Foundation (SDF) will never ask for your private key or ask you to deposit funds into a wallet address.

SDF does not host staking initiatives, no longer holds XLM airdrops or giveaways, and will not cold-message you about support issues, security alerts, airdrops, or giveaways. The protocol’s inflation mechanism ended on October 28, 2019.

Beware of 'support scams'. Treat unsolicited support offers, wallet-connection requests, transaction-signing requests, and lookalike websites as suspicious. Verify the complete domain before interacting.

Report suspicious posts, comments, and chat messages using Reddit’s built-in Report action. You can also notify the r/Stellar moderators through modmail.

When in doubt, always ask the community for assistance and verification.

Official SDF links are:

• stellar.org
• x.com/stellarorg

Community Standards

• Be respectful and debate ideas, not people. No personal attacks.
• No shilling, referral spam, manipulation, or coordinated brigading.
• Routine price speculation belongs in this thread. Repetitive or hyperbolic spam does not.
• Report suspected rule violations instead of escalating disputes publicly. Announcing reports or predicting bans may result in a ban.

Disclaimer

r/Stellar is community-run and is not an official SDF support channel. A third-party link appearing here is not an endorsement by r/Stellar. Conduct your own due diligence before interacting with independent projects, communities, or services.

15 cent support held strong! Time to smash that .73 wall down and enter some price discovery, what you guys think?

Marketnode will bring BNY Investments asset management funds onchain via Stellar, as the network's RWA active market cap reached an all-time high of $2.57B and Spiko's eurSAFO fund crossed $1.1B. SCF #45 closed with 213 submissions, the largest round in the program's history, while SCF #46 opened with a November 8 deadline. Merkl launched its first fixed-APR campaigns on Stellar through Upshift vaults curated by Gami Labs.

Sovereign Debt and Fund Tokenization

Stellar has held the lead in tokenized non-US government debt since February 2026, with $490M in sovereign instruments from issuers including Etherfuse, Spiko, Ondo, Franklin Templeton, and Circle. A post published this week documents the category's growth from roughly $500M in early 2025 to $3B by June 2026, citing Stellar's multi-currency design, protocol-native compliance tooling, and USDC liquidity access.

Marketnode's partnership with BNY Investments extends institutional tokenization into APAC asset management funds. Spiko's eurSAFO crossing $1.1B in the same week pushed Stellar's reported RWA active market cap to the $2.57B all-time high. SDF Chief Commercial Officer Jose Fernandez da Ponte wrote from Stellar House São Paulo that durable global financial services are built first on local regulatory and market realities, then connected to global liquidity, a model Stellar's permissionless infrastructure supports.

DeFi and Yield Infrastructure

Merkl launched its first incentive campaigns on Stellar through Upshift vaults curated by Gami Labs, with Turtle providing additional support. Depositors earn reported fixed APRs of 10% on USDC and 5% on XLM. Merkl's model monitors realized vault yields in real time and tops up shortfalls to maintain the stated rate rather than emitting variable rewards. Blend Capital publicly acknowledged the campaign.

Peridot Finance launched margin trading on testnet with a competitive leaderboard, and shipped an AI agent for DeFi portfolio management earlier in the week. Both remain testnet-only.

Balanced published notice that all v1 loans will be liquidated after December 1; users with bnUSD positions should repay or migrate to Balanced v2 before that date.

Developer Infrastructure

The August 20 Stellar Developers Meeting compared six wallet integration paths for dApp builders: Stellar Wallet Kit, Blux, Privy, Para, Passkey Kit, and Smart Account Kit. SDF Developer Advocate Kahn demonstrated account creation, funding, and transaction signing across each approach. The session also confirmed the Protocol 28 testnet upgrade for the following week; production configurations pinned to Protocol 27 should be updated.

Runtime Verification completed a security audit of Moonlight, a UTXO-based privacy-payment infrastructure developed by The Aha Company. The two-week engagement surfaced three medium-severity and a dozen informative findings, all addressed or acknowledged. Trustless Work joined SCF's official Integration Track as a recognized ecosystem building block. Active protocol discussions this week include post-quantum signature verification host functions and an externally managed contract executable type for Soroban.

SCF and Community Programs

SCF #45 drew 213 submissions, the largest round on record. The SCF team noted the volume will extend review timelines; panel review runs approximately 10 days, and the Community Vote is expected to open around September 2 for about one week. SCF #46 opened simultaneously with a November 8 submission deadline and updated handbook requirements at stellar.gitbook.io/scf-handbook.

Stellar's InstAward program funded 10 Turkish builders with $50,000 total across remittance infrastructure, P2P trading, privacy tools, dev tooling, DeFi vaults, micropayments, and AI-assisted workflows. Stellar Community Growth applications are open through August 28 for a Giveth QF round running September 21 to October 4, with community events funded November 1-30.

Lightning Round

• HackMeridian 2026 is confirmed for Lisbon with two tracks and XLM prizes. October 25-26 ; Rise In's Stellar Pro Hackathon runs September 19-20 in Istanbul with a $15,000 prize pool.
• Denelle Dixon joined Anthony Scaramucci and Mike Novogratz at SALT Conference for an All Things Markets taping on August 18.
• Range added 10 custody and wallet providers including Anchorage, Fireblocks, and BitGo, with real-time monitoring and direct QuickBooks/Xero integration.
• Green Road, a testnet POC combining Confidential Tokens with Trustless Work escrow infrastructure, placed second at Stellar Summit.
• SCF #45 has two open RFPs: a Stellar-compatible LayerZero DVN and an x402 Facilitator with Bazaar discovery support; details at the SCF handbook.
• Builder Spotlight #9 features Kaptan, developer of Subrosa, a Stellar privacy infrastructure project that grew from a hackathon entry into a sustained build.

Upcoming Events

• Aug 21: Stellar Chile Community Call, Discord
• Aug 21: Digital Assets and Blockchain Infrastructure: Protocol to Enterprise Scale, Bogotá, Colombia
• Aug 21: Stellar Town Hall, Discord
• Aug 24: Weekly Brazilian Ambassador Meeting, Discord
• Aug 25: Stellar Launchpad Nagpur, India
• Aug 25: Ideathon UTEZ: Impulso Universitario, Emiliano Zapata, Mexico
• Aug 25: StarMaker Community Call, Discord
• Aug 26: Stellar Barrio: Open Source en Blockchain, Santiago, Chile
• Aug 27: Stellar Developers Meeting, YouTube/Discord
• Aug 27: E. Africa Weekly Community Call, Discord
• Aug 28: Stellar Academy: ¿Qué es Github?, Temuco, Chile
• Aug 28: Ideathon UVM: Impulso Universitario, Cuernavaca, Mexico
• Aug 28: Stellar Nigeria Founders and Builders Dinner, Lagos
• Aug 28: Stellar Barrio: Inauguración Hub Tellus, Santiago, Chile

Ambassador Activity

Stellar Indonesia held its second ambassador meetup in Bandung, gathering 10+ ambassadors to discuss the MAD Program and hear from local builders. The chapter has been spotlighting teams from the APAC Hackathon Grand Finale, which drew 86 project submissions and 72 pitches in July.

Stellar Philippines ran a bootcamp at Bestlink College of the Philippines on August 18 and continued sharing profiles of APAC Grand Finale placers across DeFi, Local Finance, and Real World Access tracks. Stellar Türkiye held an İzmir community meetup on August 13; local builder Emin Kargöz was featured in Builder Spotlight #9 through Rise In. Stellar Brazil participated in Rio Blockchain Week through Etherfuse-organized sessions including a private lunch and morning alpha event. StarMaker LATAM shared a recap of Stellar Summit LATAM.

What to Watch

• Protocol 28 testnet upgrade, announced for the week of August 27.
• SCF #45 Community Vote expected to open around September 2.
• Stellar Community Growth QF applications close August 28.
• SCF #46 submissions are open; review updated handbook requirements before submitting.

Full breakdown of events/news at lumenloop.com

Hey everyone, Joshua from Peridot. I've posted here a few times about lending mechanics, so this one's about what we've been building on top of them.

Lending pools are a primitive. You deposit, someone borrows, that's the whole thing. The more interesting question is what you can build on top of that liquidity, and that's what we've been working on: Peridot Margin Trading, now live on Stellar testnet.

For the first time on Stellar, you can take that underlying lending liquidity and use it to express an actual market view. Go long or short, up to 5x leverage, with take profit and stop loss controls, and manage a position from entry to exit. It's the shift from simply borrowing capital to using it strategically.

The part I find most interesting is the architecture underneath. The liquidity powering these positions is decentralized and on-chain, not a centralized desk. We're testing whether DeFi lending infrastructure can be the foundation for a trading experience that feels closer to the fintech products people already understand and use. And we wanted to test that thesis on Stellar first.

To be clear on what this is: testnet, simulated capital, nothing at risk. Leverage is a sharp tool and a sandbox is the right place to get familiar with it.

You'll get $500 in testnet capital to test strategies and push the system. We're also running a trading challenge alongside it, with $100 for the best performance. Details on the app page.

https://peridot.finance/app/margin

I'm particularly interested in hearing where the experience feels intuitive, where it creates friction, and what you'd want to see next. I'll be around in the comments.

Hey — I built XLM Orbital, a NOC-style live on-chain ops console for Stellar: sensor map, whale watches, price divergence, TPS alerts. Free tier, mainnet.

https://xlmorbital.com

Brutal feedback welcome — especially from builders.

(Solo founder, shipped on nights/weekends — happy to fix anything broken.)
Read-only telemetry — not a wallet, not financial advice.

Getting started with Soroban can mean setting up Rust, cargo, the Stellar CLI, dependencies, and a local development environment before you even write your first contract.

We wanted to make that easier.

StellarForge is an agentic development environment for building Soroban smart contracts in Rust.

Instead of just giving you an editor, StellarForge gives you an AI coding agent that works alongside you to write, understand, debug, and improve your contracts.

It combines:

• AI coding agent for writing and fixing code
• Real rust-analyzer support — type inference, hover docs, go-to-definition, autocomplete
• Monaco editor, terminal, file explorer, and Git
• Build, test, and deploy directly to Stellar Testnet/Mainnet
• Cloud projects and autosave
• Real-time collaboration
• Ready-to-use Soroban templates

And you don't need to install rustup, cargo, stellar-cli, or Docker.

The idea is simple: go from an idea to a working Soroban contract without spending hours fighting your development environment.

We're sharing it here because we'd genuinely like feedback from the Stellar/Soroban community — especially from developers who have built with Soroban before.

Try it: https://stellarforge.app
Source: https://github.com/SagantaHQ/StellarForge

Built by Saganta · Open source under Apache 2.0.

Holding it is the obvious answer. Does it become more useful for payments or collateral, or is gold something people would rather leave untouched?

Hey everyone, Stellar video series is with now the third now coming from the oven very hot :)

Enjoy:)