{
 "slug": "stablr-1of3-multisig-key-may-2026",
 "title": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
 "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026",
 "json": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "chains": [
  "ethereum"
 ],
 "method": "key-leak",
 "product": "StablR EURR and USDR stablecoins and holders",
 "tags": [
  "ethereum",
  "key-leak",
  "stablr",
  "eurr",
  "usdr",
  "stablecoin",
  "multisig",
  "1-of-3",
  "private-key-compromise",
  "depeg"
 ],
 "amountUsd": 2800000,
 "victims": null,
 "startedAt": "2026-05-23",
 "closedAt": "2026-05-24",
 "updatedAt": "2026-05-24T12:00:00Z",
 "summary": "On 23-24 May 2026 an attacker used the compromised private key of one signer on StablR's 1-of-3 minting multisig to add themselves as owner, replace the other owners and mint 8.35M USDR and 4.5M EURR, about $13.5M face value. They dumped about $10.4M of it on DEXs for ETH, with early net proceeds estimated at $2.8M, pushing USDR as low as $0.40 and EURR to about $0.85. ZachXBT said he helped freeze a six-figure sum.",
 "timeline": [
  {
   "date": "2026-05-23",
   "title": "ZachXBT flagged the exploit at 9:46 PM ET after the attacker minted 8.35M USDR and 4.5M EURR through the minting multisig.",
   "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit"
  },
  {
   "date": "2026-05-24",
   "title": "StablR acknowledged an exploit on X about eight hours after on-chain activity stopped; Blockaid attributed it to one signer's compromised key on a 1-of-3 multisig.",
   "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "StablR's EURR and USDR depeg after attacker mints $13.5 million in unbacked tokens through multisig exploit",
   "url": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit",
   "publisher": "The Block",
   "date": "2026-05-24"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": [
   "0x09be1a36c2d7f9909eb3d6f9184c6e46a12b0aca"
  ]
 },
 "brief": "## Am I affected?\nIf you held EURR or USDR, or provided liquidity in pools containing them, around 23-24 May 2026.\n\n## What to do now\n- Don't buy the depeg expecting a quick recovery; wait for StablR's official recovery details.\n- The attacker also used admin powers to blacklist and burn some holders' tokens; check your balance and contact StablR only through official channels.\n\n## How to avoid this\n- Check a stablecoin's mint controls before holding it: a 1-of-3 multisig means one stolen key can mint without limit.\n- For teams: use higher signing thresholds, hardware-backed keys, timelocks on owner changes and hard mint caps.",
 "notes": null,
 "agentBrief": "# StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key\n\n- Severity: Critical · Status: Partly contained (past)\n- Chains: Ethereum · Method: Leaked private keys and seed phrases\n- Started: May 23, 2026 · Last update: May 24, 2026 · Reported stolen: $2.8M\n- Who/what: StablR EURR and USDR stablecoins and holders\n\nOn 23-24 May 2026 an attacker used the compromised private key of one signer on StablR's 1-of-3 minting multisig to add themselves as owner, replace the other owners and mint 8.35M USDR and 4.5M EURR, about $13.5M face value. They dumped about $10.4M of it on DEXs for ETH, with early net proceeds estimated at $2.8M, pushing USDR as low as $0.40 and EURR to about $0.85. ZachXBT said he helped freeze a six-figure sum.\n\n## Am I affected?\nIf you held EURR or USDR, or provided liquidity in pools containing them, around 23-24 May 2026.\n\n## What to do now\n- Don't buy the depeg expecting a quick recovery; wait for StablR's official recovery details.\n- The attacker also used admin powers to blacklist and burn some holders' tokens; check your balance and contact StablR only through official channels.\n\n## How to avoid this\n- Check a stablecoin's mint controls before holding it: a 1-of-3 multisig means one stolen key can mint without limit.\n- For teams: use higher signing thresholds, hardware-backed keys, timelocks on owner changes and hard mint caps.\n\n## Indicators (block these, never visit them)\n- Address: 0x09be1a36c2d7f9909eb3d6f9184c6e46a12b0aca\n\n## Sources\n- StablR's EURR and USDR depeg after attacker mints $13.5 million in unbacked tokens through multisig exploit (The Block, 2026-05-24): https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit\n\nFull record: https://drains.watch/i/stablr-1of3-multisig-key-may-2026 · JSON: https://drains.watch/i/stablr-1of3-multisig-key-may-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}