StablR Exploit Explained: EURR and USDR Depeg After $2.8M Ethereum Attack

On May 24, 2026, blockchain security firm Blockaid triggered a community alert: an ongoing exploit was actively draining funds from StablR, a Malta-licensed, MiCA-compliant stablecoin issuer backed by Tether. By the time containment efforts were underway, roughly $2.8 million had been extracted on Ethereum, both of StablR’s tokens had lost their pegs, and the broader stablecoin industry had been handed its second major single-key mint exploit in 62 days.

This is not just a story about one hack. It is a story about what regulated really means when the vault is unlocked by a single private key.

StablR: Background and Tether’s Strategic Bet

To understand why this exploit matters beyond its dollar figure, you need to understand what StablR was supposed to represent.

Founded in 2023 and headquartered in Malta, StablR operates two Ethereum-native stablecoins: EURR, pegged to the euro, and USDR, pegged to the US dollar. In July 2024, it secured an Electronic Money Institution license from the Malta Financial Services Authority, positioning both tokens as fully MiCA-compliant assets ahead of the regulation’s full enforcement on December 30, 2024.

Then came Tether.

As MiCA forced Tether to shut down its own euro stablecoin, EURT, the company needed a proxy for maintaining its European footprint. In December 2024, Tether took a “significant equity position” in StablR, pairing the investment with integration of its Hadron tokenization platform. Hadron covers KYC, AML, risk management, and secondary market monitoring. Tether had already watched OKX delist USDT across Europe and faced a broader wave of delistings at Coinbase, Kraken, and Crypto.com. StablR, with its MFSA license and clean regulatory profile, became the vehicle through which Tether would stay in the room.

Paolo Ardoino, Tether’s CEO, personally endorsed StablR’s MiCA positioning in late 2024, calling the European stablecoin market “poised for significant growth.” MiCA had by then become the most comprehensive crypto regulatory framework in the world, covering reserve requirements, redemption rights, monthly proof-of-reserves, and issuance licensing. StablR checked every box MiCA required.

None of those boxes covered multisig thresholds on mint contracts.

Inside the Exploit: One Key, $10.4 Million in Tokens

On May 24, 2026, StablR’s mint contract required one valid signature out of three possible signers. That architecture, a 1-of-3 multisig, meant any single key holder could authorize unlimited issuance without coordination or consensus from the others.

One key was stolen.

Within the window of the attack, the exploiter minted 8.35 million USDR and 4.5 million EURR against zero collateral. At face value, those tokens represented $10.4 million. The attacker then dumped both assets across decentralized exchanges, generating sell pressure that drove both tokens sharply below their pegs. After accounting for DEX slippage and market impact, the realized extraction came to 1,115 ETH, approximately $2.8 million.

The blockchain did not malfunction. The smart contracts executed exactly as designed. The signatures were cryptographically valid. What was missing was any layer between key access and issuance authority. The protocol had no on-chain mint caps, no oracle checks against collateral ratios, and no time-locks that would have delayed or flagged unusual issuance volume.

StablR issued a brief security update confirming it had identified an exploit and was working to contain it.

EURR and USDR: How Far Did They Fall?

EURR carries a $14 million market capitalization. According to CoinGecko, it lost 23% of its value, falling from its $1.15 euro peg to approximately $0.88. USDR depegged by roughly 30%.

For context, EURR had grown from a $3.4 million market cap at the time of Tether’s investment in December 2024 to $14 million by May 2026, representing meaningful adoption growth that was wiped out in hours.

For holders who had taken positions in either token on the assumption that MiCA compliance was a proxy for structural safety, the depeg was a rude correction.

Sixty-Two Days Earlier: Resolv USR Set the Template

This was not the first time in 2026 that a single compromised key dismantled a stablecoin’s peg. On March 22, 2026, Resolv Labs suffered a near-identical exploit.

An attacker accessed Resolv’s AWS Key Management Service environment, where the protocol’s privileged signing key was stored. Using roughly $200,000 in USDC as deposit collateral, the attacker minted approximately 80 million unbacked USR tokens and sold them across DEXes. The realized extraction came to roughly $25 million in ETH. USR briefly traded at 2.5 cents on Curve before partial recovery.

As security analyst Shanaka Perera noted publicly after the StablR incident, the structural mechanism in both events is identical: one effective key, zero collateral checks, and full mint authority. Resolv’s SERVICE_ROLE, the privileged account controlling minting, was a single externally-owned address rather than a multisig. StablR’s 1-of-3 multisig was, in practice, only as strong as its weakest key.

Two events. Same mechanism. Sixty-two days apart.

What MiCA Covers and What It Does Not

MiCA took full effect on December 30, 2024, mandating 100% fiat reserves, monthly proof-of-reserves, redemption rights, and CASP licensing across all 27 EU member states. It is the most comprehensive stablecoin regulatory framework ever implemented anywhere in the world.

MiCA does not mandate multisig thresholds or require hardware security modules. It also does not require multi party computation for signing authority.

MiCA regulates what is in the vault. It does not regulate who holds the key to the vault, or how many people must agree before that key can authorize new supply.

Hadron, Tether’s compliance platform integrated into StablR’s operations, is marketed as covering KYC, AML, risk management, and secondary market monitoring. None of those tools enforced a minimum signature threshold on the issuance contract. Compliance infrastructure designed to catch bad actors during onboarding cannot catch an attacker who already has a valid private key.

2026’s Broader Exploit Landscape

StablR’s exploit does not exist in isolation. The year 2026 has already seen more than $1 billion lost to DeFi hacks and exploits, and the attack patterns have shifted meaningfully toward operational compromise rather than smart contract bugs.

• The Drift Protocol hack on April 1, 2026, drained roughly $285 million from the Solana-based perpetuals exchange after a social engineering campaign compromised an administrative key. The code worked correctly. The humans holding the keys did not. KelpDAO followed later that month with a $292 million bridge exploit, currently the largest single DeFi hack of 2026.
• The Verus-Ethereum Bridge was exploited on May 18, 2026, with attackers abusing a validation flaw to release assets on Ethereum without proper confirmation on the Verus side, draining over 5,400 ETH. Echo Protocol and THORChain have also featured in 2026’s growing ledger of infrastructure compromises, with stolen funds from multiple incidents funneled through cross-chain routing to obscure recovery paths.
• Polymarket faced a security incident in late 2025 when a vulnerability in a third-party authentication provider allowed unauthorized account drains, and a prior phishing campaign that year had already cost users $500,000. The lesson repeated across every incident: perimeter compliance does not equal operational security.

As CCN’s analysis of DeFi vulnerabilities noted, the shift from purely technical exploits to attacks targeting operations, access controls, and cross-protocol systems defines 2026’s threat landscape. Audited code and licensed issuers alike have proven equally penetrable when the attack surface is a human holding a key.

Revocation Cost and What It Reveals

Stablecoin security can be measured, in part, by its revocation cost: what it takes to either freeze supply or mint unbacked tokens. That cost varies enormously across issuers.

Bitcoin’s revocation cost is, effectively, the cost of overwhelming proof-of-work consensus, currently valued in the tens of billions of dollars in equivalent hash power. USDC’s revocation cost involves compromising Circle’s multisig infrastructure, operating under per-minter quotas with monthly Deloitte attestations and institutional custody. At $75 billion in supply, no material incidents have occurred.

StablR’s revocation cost, as demonstrated on May 24, was the compromise of a single private key.

This critique is not unique to StablR. It applies to what the industry calls “regulated.” A license from the MFSA, monthly proof of reserves and Tether backing are real credentials. They satisfy every requirement MiCA imposes on stablecoin issuers operating in the European Union. By themselves, however, they do not raise the cost of unbacked issuance beyond a single stolen key.

As Tether thrived financially through its MiCA repositioning, backing compliant proxies rather than seeking its own EU authorization, the structural question was always whether compliance paperwork and cryptographic security were being conflated. StablR’s exploit answered that question in 1,115 ETH.

What Comes Next for Stablecoin Security

The fix is not conceptually complicated. Minimum multisig thresholds of 2-of-3 or 3-of-5 for mint authority would require coordinated key compromise rather than a single stolen credential. Hardware security modules, which store signing keys in tamper-resistant hardware, dramatically raise the cost of key extraction. Multi-party computation signatures distribute key material across participants so no single node ever holds a complete key. Time-locks on large issuance events would create windows for anomaly detection before damage is done.

None of these are exotic technologies. They are standard practices in institutional custody and critical infrastructure. The gap is not technical. It is regulatory: MiCA does not require any of them, and compliant issuers are not incentivized to implement them beyond the cost of the next exploit.

Two stablecoin depeg events in 62 days, both caused by single-key failures, together extracting nearly $28 million at realized value, with the face value of unbacked tokens minted exceeding $90 million, should concentrate regulatory attention. The global stablecoin market has crossed $322 billion. At that scale, the cost of regulating only the vault, while leaving the key unguarded, is no longer theoretical.

Regulated stablecoin is a compliance category. What happened to StablR on May 24, 2026, was a reminder that it is not yet a security standard.

FAQs

About the Author

Dr. Guneet Kaur

Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.

Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.

[email protected] LinkedIn