A serious security breach has rocked StablR, causing its euro and dollar stablecoins, EURR and USDR, to lose their pegs following a suspected private key compromise. Blockchain security firm Blockaid detected the ongoing attack on Ethereum, with approximately $2.8 million drained from the issuer’s smart contracts.
According to Blockaid, the vulnerability stemmed from a 1-of-3 multi-signature setup for minting permissions. A single compromised private key allowed the attacker to gain full control, adding themselves as an owner and removing the two legitimate ones. The perpetrator then minted 8.35 million USDR and 4.5 million EURR, flooding the market with new supply that pushed prices away from their intended values.
The attacker attempted to convert the newly minted tokens via decentralized exchanges. Despite a face value of about $10.4 million, thin liquidity meant they only realized 1,115 ether, worth roughly $2.8 million. Blockaid emphasized that this was not a smart contract issue but a failure in key management and governance.
Market data reflected the immediate impact. CoinGecko showed EURR trading near $0.908, a drop of over 21% in 24 hours, while CoinMarketCap reported EURR at approximately $0.8995, down more than 22%. USDR similarly fell below its $1 peg, hitting around $0.7225.
StablR is a regulated stablecoin issuer backed by reserves in segregated accounts. Its tokens run on Ethereum and Solana. Notably, Tether invested in StablR in December 2024, and the two companies later launched MiCA-compliant payment support in Europe through Oobit. The current exploit adds to a series of security incidents in May, including the Verus bridge exploiter returning part of stolen funds and Resolv Labs’ USR depeg after an unbacked token minting.