StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key
StablR EURR and USDR stablecoins and holders
On 23-24 May 2026 an attacker used the compromised private key of one signer on StablR's 1-of-3 minting multisig to add themselves as owner, replace the other owners and mint 8.35M USDR and 4.5M EURR, about $13.5M face value. They dumped about $10.4M of it on DEXs for ETH, with early net proceeds estimated at $2.8M, pushing USDR as low as $0.40 and EURR to about $0.85. ZachXBT said he helped freeze a six-figure sum.
Why this severity: $2.8M reported stolen, only partly contained.
- Started
- May 23, 2026
- Closed
- May 24, 2026
- Chains
- Ethereum
- Reported stolen
- $2.8M
Indicators · never visit or send to these
- 0x09be1a36c2d7f9909eb3d6f9184c6e46a12b0aca
What to do now
- Don't buy the depeg expecting a quick recovery; wait for StablR's official recovery details.
- The attacker also used admin powers to blacklist and burn some holders' tokens; check your balance and contact StablR only through official channels.
Stay safe
Am I affected?
If you held EURR or USDR, or provided liquidity in pools containing them, around 23-24 May 2026.
What to do now
- Don't buy the depeg expecting a quick recovery; wait for StablR's official recovery details.
- The attacker also used admin powers to blacklist and burn some holders' tokens; check your balance and contact StablR only through official channels.
How to avoid this
- Check a stablecoin's mint controls before holding it: a 1-of-3 multisig means one stolen key can mint without limit.
- For teams: use higher signing thresholds, hardware-backed keys, timelocks on owner changes and hard mint caps.
Timeline 2
News & write-ups ›1
How this method works
A private key or seed phrase ends up somewhere readable: code on GitHub, an env file, a hacked server or cloud notes. Bots find it within minutes. Read about leaked private keys and seed phrases →
Follow new drains and updates in your feed reader or Telegram RSS bot.