StablR's EURR and USDR depeg after attacker mints $13.5 million in unbacked tokens through multisig exploit

Stablecoins issued by Tether- and Kraken-backed European stablecoin issuer StablR lost their pegs Saturday night and into Sunday morning ET, after an attacker took administrative control of the issuer's minting contract and printed millions in fresh tokens before dumping them on decentralized exchanges.

Onchain investigator ZachXBT flagged the incident publicly at 9:46 PM ET Saturday, posting to his investigations channel that two contracts tied to StablR appeared to have been potentially exploited for around $10 million across EURR and USDR. He noted that the attacker's wallet had been funded via Circle's Cross-Chain Transfer Protocol (CCTP) on Noble.

In a follow-up at 11:52 PM ET Saturday, ZachXBT said he had helped freeze a six-figure sum of the stolen funds. He added that the StablR team appeared to be "asleep" while the attack remained active more than three hours in.

Blockchain security firm Blockaid attributed the breach to a private key compromise affecting one signer on StablR's minting multisig, which was secured by just a 1-of-3 signature threshold. The attacker added themselves as an administrator, replaced the existing owners, and minted 8.35 million USDR and 4.5 million EURR (for a total value of about $13.5 million) in the first hours of the attack, per Blockaid.

Roughly $10.4 million in face value was then swapped for ETH across decentralized exchanges, Blockaid said, with net proceeds in the first hours of the attack estimated at $2.8 million after slippage on thin liquidity. The firm emphasized that the failure was a governance and key-management issue rather than a flaw in StablR's smart contract code.

The attacker also used the multisig's administrative powers to blacklist and burn tokens already held by counterparties, in at least one case incinerating roughly 2.7 million EURR worth approximately $2.4 million from a wallet that had been processing routine redemptions with StablR for months, per onchain records reviewed by The Block. The transaction was confirmed by a wallet ZachXBT identified as belonging to the attacker.

Realized proceeds appear to have grown beyond that initial estimate as the attack continued. A consolidation wallet later tagged by Etherscan as "StablR Exploiter 2" held 1,488 ETH worth approximately $3.15 million as of Sunday morning ET, per Etherscan data reviewed by The Block.

StablR acknowledged the exploit at 8:10 AM ET Sunday, about eight hours after onchain activity on the affected contracts had apparently stopped. The company said in a statement on X that it had identified an exploit affecting the protocol and was working to contain it and minimize impact. StablR added that it will share verified details and next steps as soon as possible.

EURR was trading near $0.85 as of Sunday morning ET, down about 26% over 24 hours from its peg near $1.15 (the dollar value of its euro peg), per CoinGecko data. USDR fell harder, trading near $0.64 as of publication time, a roughly 36% decline on the day.

Notable setback for StablR

The exploit is a notable setback for an issuer that has positioned itself as a flagship for compliant European stablecoin issuance under the EU's Markets in Crypto-Assets (MiCA) framework. StablR holds an Electronic Money Institution license from the Malta Financial Services Authority and uses Tether's Hadron tokenization platform.

The company secured a strategic equity investment from Tether in Dec. 2024 for an undisclosed sum as the stablecoin giant retreated from the European market ahead of MiCA's Dec. 30, 2024 implementation deadline. Kraken followed with its own strategic investment in July 2025.

StablR said in its July announcement that EURR and USDR had crossed €3 billion in transaction volume in the first half of 2025 and were listed on more than 50 exchanges with over 150 trading pairs.

The apparent 1-of-3 multisig threshold that secured StablR's minting functions raises questions about StablR's operational posture. By comparison, Harmony's cross-chain Horizon bridge used a 2-of-5 multisig before being drained for $100 million in 2022, a setup security analysts at the time had already characterized as insufficient. StablR did not immediately respond to a request for further information from The Block. 

"We focus on security, compliance, and usability—helping consumers, merchants, and institutions transact with confidence," StablR has said in a past press release.

Sunday's incident is the latest in a 2026 pattern in which privileged-access, governance and key-management failures, rather than novel smart contract bugs, have driven the year's costliest exploits. The April 1 Drift Protocol hack, which resulted in over $280 million in losses on the Solana-based perpetuals exchange, also routed proceeds through Circle's CCTP. April was the most-hacked month in crypto history by incident count, according to DefiLlama.

The depeg also lands at a politically challenging moment for euro stablecoin policy. On Friday, the European Central Bank rebuffed a Bruegel think tank proposal to loosen liquidity requirements for euro stablecoin issuers and potentially extend ECB backstops to the sector, per a Reuters report cited by The Block. ECB President Christine Lagarde argued earlier this month that the case for euro-denominated stablecoins is "far weaker than it appears," citing financial stability risks.

Expand Chart

Total euro stablecoin supply on Ethereum remains a fraction of the dollar-pegged market, per The Block's data, accounting for about 0.24% of the overall Ethereum fiat-backed stablecoin supply.

This is a developing story.