Stellar suffered a critical inflation bug in April 2017 where an attacker exploited the merge function to create 2.2 billion XLM (worth ~$10M at the time). The SDF patched the bug, disclosed it in release notes, and burned equivalent XLM from reserves to prevent dilution.