StablR attacker mints unbacked USDR and EURR stablecoins; redemption still suspended
An attacker used one compromised minting key to create unbacked USDR and EURR stablecoins on 23–24 May, crashing their prices. As of late October, redemption is still suspended with no resumption date or compensation scheme.
If you hold EURR or USDR, you can't redeem them for now, so don't buy more and don't trust any message offering a redemption. Follow StablR's own notices at stablr.com; it says it will never ask for private keys, seed phrases or payment.
What’s happening
On 23 and 24 May 2026 an attacker took control of the minting wallets for StablR's euro stablecoin EURR and dollar stablecoin USDR. Blockaid attributed it to one compromised signer key on a multisig that needed only one of three signatures. Early reports put the minting at 8.35 million USDR and 4.5 million EURR, about US$13.5 million at face value. The attacker sold much of it into thin markets for estimated net proceeds of US$2.8 million. EURR fell to about US$0.85 and USDR as low as US$0.40. Only a six-figure sum was reported frozen. StablR suspended minting and redemption and asked exchanges to halt trading. In its 25 August notice, StablR said about 6.41 million EURR and 14.33 million USDR were created without authorisation or payment and are unbacked. It says reserves were unaffected, properly issued tokens remain fully backed, and a Recovery Plan is running with Malta's regulator, the MFSA. Per advocacy group EFRI, the 19 October update reported no material developments. Redemption remains suspended with no resumption date, compensation scheme or claims process published. The figures differ between early press and StablR's own later numbers. No arrests or recovery of the stolen funds are reported.
- What
- Breach
- Affects
- StablR EURR and USDR stablecoins
- Fixed in
- Nothing to patch
- Since
- 23 May 2026
- Closed
- 19 Oct 2026
Timeline
- UpdateNothing to patch
Per advocacy group EFRI, StablR's latest update reported no material developments, did not repeat the August backing statements, and gave no date for resuming redemption. EFRI said no compensation scheme or claims process had been published.
- UpdateNothing to patch
StablR said about 6.41 million EURR and 14.33 million USDR were minted without authorisation or payment and are not backed by reserves. It said the incident remained contained, reserves in segregated accounts were not affected, properly issued tokens remain fully backed, and a Recovery Plan was active with the MFSA. Minting and redemption stayed suspended, with 'orderly resumption' promised in due course.
- UpdateNothing to patch
StablR suspended minting and redemption of USDR and EURR and asked exchanges to halt trading, deposits and withdrawals. It said it had started an investigation and would report the incident to Maltese regulators, per a relayed CoinDesk report.
- UpdateNothing to patch
StablR acknowledged an exploit on X about eight hours after onchain activity stopped. Blockaid attributed it to one compromised signer key on a minting multisig that needed only one of three signatures. The attacker minted about 8.35 million USDR and 4.5 million EURR (roughly US$13.5 million face value), sold about US$10.4 million of it on thin liquidity for estimated net proceeds of US$2.8 million, and pushed EURR to about US$0.85 and USDR as low as US$0.40.
- Made publicNothing to patch
Onchain investigator ZachXBT flagged that two StablR-linked contracts appeared to have been exploited for about US$10 million. He later said he had helped freeze a six-figure sum of the stolen funds.
Sources
- Notification — August 25thStablR · 25 Aug 2026
- StablR's EURR and USDR depeg after attacker mints $13.5 million in unbacked tokens through multisig exploitThe Block · 24 May 2026
- StablR Suspends USDR and EURR Operations Following Hacking IncidentKuCoin News · 26 May 2026
- StablR: Five Months OnEFRI · 19 Oct 2026