# StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key

- Severity: Critical · Status: Partly contained (past)
- Chains: Ethereum · Method: Leaked private keys and seed phrases
- Started: May 23, 2026 · Last update: May 24, 2026 · Reported stolen: $2.8M
- Who/what: StablR EURR and USDR stablecoins and holders

On 23-24 May 2026 an attacker used the compromised private key of one signer on StablR's 1-of-3 minting multisig to add themselves as owner, replace the other owners and mint 8.35M USDR and 4.5M EURR, about $13.5M face value. They dumped about $10.4M of it on DEXs for ETH, with early net proceeds estimated at $2.8M, pushing USDR as low as $0.40 and EURR to about $0.85. ZachXBT said he helped freeze a six-figure sum.

## Am I affected?
If you held EURR or USDR, or provided liquidity in pools containing them, around 23-24 May 2026.

## What to do now
- Don't buy the depeg expecting a quick recovery; wait for StablR's official recovery details.
- The attacker also used admin powers to blacklist and burn some holders' tokens; check your balance and contact StablR only through official channels.

## How to avoid this
- Check a stablecoin's mint controls before holding it: a 1-of-3 multisig means one stolen key can mint without limit.
- For teams: use higher signing thresholds, hardware-backed keys, timelocks on owner changes and hard mint caps.

## Indicators (block these, never visit them)
- Address: 0x09be1a36c2d7f9909eb3d6f9184c6e46a12b0aca

## Sources
- StablR's EURR and USDR depeg after attacker mints $13.5 million in unbacked tokens through multisig exploit (The Block, 2026-05-24): https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit

Full record: https://drains.watch/i/stablr-1of3-multisig-key-may-2026 · JSON: https://drains.watch/i/stablr-1of3-multisig-key-may-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.