{
 "tag": "depeg",
 "name": "Depeg",
 "group": "Other",
 "incidents": [
  {
   "slug": "stablr-1of3-multisig-key-may-2026",
   "title": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026",
   "json": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "StablR EURR and USDR stablecoins and holders",
   "tags": [
    "ethereum",
    "key-leak",
    "stablr",
    "eurr",
    "usdr",
    "stablecoin",
    "multisig",
    "1-of-3",
    "private-key-compromise",
    "depeg"
   ],
   "amountUsd": 2800000,
   "victims": null,
   "startedAt": "2026-05-23",
   "closedAt": "2026-05-24",
   "updatedAt": "2026-05-24T12:00:00Z",
   "summary": "On 23-24 May 2026 an attacker used the compromised private key of one signer on StablR's 1-of-3 minting multisig to add themselves as owner, replace the other owners and mint 8.35M USDR and 4.5M EURR, about $13.5M face value. They dumped about $10.4M of it on DEXs for ETH, with early net proceeds estimated at $2.8M, pushing USDR as low as $0.40 and EURR to about $0.85. ZachXBT said he helped freeze a six-figure sum."
  },
  {
   "slug": "resolv-usr-minting-key-compromise-mar-2026",
   "title": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026",
   "json": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "Resolv Labs USR stablecoin and holders",
   "tags": [
    "ethereum",
    "key-leak",
    "resolv",
    "usr",
    "stablecoin",
    "depeg",
    "private-key-compromise",
    "off-chain-signer",
    "minting"
   ],
   "amountUsd": 24500000,
   "victims": null,
   "startedAt": "2026-03-21",
   "closedAt": "2026-04-01",
   "updatedAt": "2026-04-01T12:00:00Z",
   "summary": "On 21 March 2026 an attacker obtained a privileged private key used by Resolv's off-chain minting service, deposited about $100K-$200K in USDC and minted about 80M USR, which the contracts did not cap. They swapped out for about 11,408 ETH, roughly $24.5M, and USR fell to about 26 cents. Resolv paused its app, offered the attacker a 10% bounty and asked holders not to trade USR while it works on recovery."
  }
 ],
 "changes": [
  {
   "incident": "stablr-1of3-multisig-key-may-2026",
   "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-24",
   "title": "StablR acknowledged an exploit on X about eight hours after on-chain activity stopped; Blockaid attributed it to one signer's compromised key on a 1-of-3 multisig.",
   "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026"
  },
  {
   "incident": "stablr-1of3-multisig-key-may-2026",
   "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-23",
   "title": "ZachXBT flagged the exploit at 9:46 PM ET after the attacker minted 8.35M USDR and 4.5M EURR through the minting multisig.",
   "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026"
  },
  {
   "incident": "resolv-usr-minting-key-compromise-mar-2026",
   "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "Halborn's March review attributed the roughly $23M loss to a compromised key of an off-chain service, with no on-chain check on mint amounts.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-march-2026",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026"
  },
  {
   "incident": "resolv-usr-minting-key-compromise-mar-2026",
   "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-23",
   "title": "Resolv temporarily paused its app and later enabled redemptions while contacting verified holders.",
   "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026"
  },
  {
   "incident": "resolv-usr-minting-key-compromise-mar-2026",
   "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-21",
   "title": "Using a stolen privileged signing key, the attacker deposited roughly $100K-$200K in USDC, minted about 80M unbacked USR and traded it for about 11,408 ETH; USR fell to about 26 cents.",
   "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026"
  }
 ]
}