Ongoing exploit targeting StabilR, a regulated issuer of euro and dollar stablecoins, has led to a sharp depeg of its two primary assets — EURR and USDR — with approximately $2.8 million extracted so far.
Blockchain security firm Blockaid reported Sunday that its exploit detection system flagged unusual activity on the StabilR issuer. The suspected cause is the compromise of a private key belonging to one owner of the minting multisignature account, which used a weak 1-of-3 threshold.
According to Blockaid, the attacker added themselves as an owner, replaced the other two owners, and proceeded to mint 8.35 million USDR and 4.5 million EURR. Due to thin liquidity, the attacker swapped the minted tokens — valued at around **$10.4 million** on paper — for just **1,115 ETH** (~$2.8 million).
“This is not a smart contract bug — it’s a key management and governance failure,” Blockaid stated.
📉 Stablecoins Depeg Hard
· EURR (€14 million market cap) depegged 23% from its $1.15 peg to **$0.88** in EUR/USD markets.
· USDR ($11 million market cap) fell 30% to **$0.70**.
StabilR issues regulated, collateralized stablecoins with reserves held in segregated accounts at top-tier institutions. The company emphasizes regulatory compliance, proof-of-reserves transparency, and availability on Ethereum and Solana. In December 2024, Tether — the world’s largest stablecoin issuer — invested in StabilR.
🔐 A Bad Month for DeFi Security
May has seen over a dozen major exploits, per DeFiLlama. Notable incidents include:
· Verus Bridge
· Echo Protocol
· Polymarket
Compromised private keys are becoming a common attack vector. Over the past two months, Volo Vault, Wasabi Perps, Echo Bridge, and Polymarket were all hit due to poor key management.
Meanwhile, on May 21, Bitcoin cross-chain bridge Map Protocol was exploited via a smart contract bug, allowing an attacker to mint a quadrillion MAPO tokens.