A live exploit targeting StablR’s issuer has driven its Euro and USD-pegged stablecoins away from parity, with roughly $2.8 million extracted so far, according to blockchain security firm Blockaid.
Blockaid said the incident appears to stem from a compromised private key within a 1-of-3 minting multisignature account. The attacker added themselves, replaced the other owners, and minted 8.35 million USDR and 4.5 million EURR, triggering the depeg.
“This is not a smart contract bug — it’s a key management and governance failure,” Blockaid said.
The attacker swapped the minted tokens for around 1,115 ETH (about $2.8 million) on decentralized exchanges, a move constrained by thin liquidity in the market for these assets.
Blockaid’s assessment underscores a governance weakness rather than a flaw in the token contracts themselves.
May has seen a string of crypto and DeFi exploits, with DeFiLlama tallying more than a dozen major incidents this month. Notable cases include THORChain, Verus Bridge, Echo Protocol and Polymarket.
StablR depeg details and price signals
EURR, StablR’s euro-denominated stablecoin with a market capitalization around $14 million, has lost about 23% of its value, trading around $0.88, according to CoinGecko. USDR, a dollar-pegged stablecoin with roughly $11 million in market cap, has slumped about 30% to around $0.70 in the ongoing incident.
StablR emphasizes that its euro and USD stablecoins are regulated, collateralized assets with reserves held in segregated accounts at top-tier institutions, and they are available on Ethereum and Solana. Tether invested in StablR in December 2024, signaling institutional interest in Europe-focused stablecoins. There have been no updates on StablR’s X feed at press time.
PeckShield flagged the EURR depeg in its alerts, underscoring the ongoing price dislocations in these assets.
Broader DeFi risk landscape this May
As this incident unfolds, the wider DeFi space continues to grapple with security challenges tied to private-key and governance weaknesses. In the past two months, Volo Vault, Wasabi Perps, Echo Protocol and Polymarket have all suffered exploits tied to private or admin-key access. Separately, Map Protocol, a cross-chain bridge linked to Bitcoin-anchored assets, experienced a smart-contract bug on May 21 that minted a quadrillion MAPO tokens, highlighting how fast-moving cross-chain projects remain vulnerable to unexpected token minting events.
What this means for investors and builders
For investors and users, the StablR incident serves as a reminder that peg stability in regulated, collateralized stablecoins hinges not just on the token contracts but on governance and key-management practices. A weak multisignature threshold — such as 1-of-3 — can leave an issuer exposed to takeover if even a single owner is compromised. The episode also tests the resilience of reserve-backed models when liquidity is thin, complicating recovery efforts after a depeg.
From a market-structure perspective, the event underscores the importance of clear proof-of-reserves, robust custody for private keys, and rigorous governance reviews, particularly for issuers with institutional backers—such as Tether’s stake in StablR. It also raises questions about the pace and transparency of post-incident recoveries, and how on-chain data will reflect liquidity recovery and peg restoration.
Looking ahead, readers should monitor StablR’s communications and any forthcoming audits or contingency plans, as well as how regulators respond to stablecoin governance incidents and asset-liability disclosures. The next few weeks will be telling for the credibility of regulated collateralized stablecoins amid a broad pattern of DeFi breaches this year.
Readers should watch for StablR’s official updates and any audits or contingency measures, as peg stability and governance resilience remain under close scrutiny in a rapidly evolving DeFi environment.
