{
 "tag": "stablecoin",
 "name": "Stablecoin",
 "group": "Other",
 "incidents": [
  {
   "slug": "address-poisoning-305k-dai-oct-2026",
   "title": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026",
   "json": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "address-poisoning",
   "product": "A DAI holder sending to a regular counterparty",
   "tags": [
    "multi-evm",
    "address-poisoning",
    "dust-attack",
    "lookalike-address",
    "dai",
    "stablecoin",
    "goplus"
   ],
   "amountUsd": 305000,
   "victims": 1,
   "startedAt": "2026-10-04",
   "closedAt": null,
   "updatedAt": "2026-10-05T12:00:00Z",
   "summary": "On 4 October 2026 GoPlus Security flagged a loss of about $305,000 in DAI. The attacker made an address with the same first and last characters as the victim's usual recipient, sent dust transfers so it appeared in the victim's history, and the victim copied it for a large transfer. GoPlus warned these campaigns are now fully automated, from finding targets to laundering. Reports did not name the chain."
  },
  {
   "slug": "stablr-1of3-multisig-key-may-2026",
   "title": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026",
   "json": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "StablR EURR and USDR stablecoins and holders",
   "tags": [
    "ethereum",
    "key-leak",
    "stablr",
    "eurr",
    "usdr",
    "stablecoin",
    "multisig",
    "1-of-3",
    "private-key-compromise",
    "depeg"
   ],
   "amountUsd": 2800000,
   "victims": null,
   "startedAt": "2026-05-23",
   "closedAt": "2026-05-24",
   "updatedAt": "2026-05-24T12:00:00Z",
   "summary": "On 23-24 May 2026 an attacker used the compromised private key of one signer on StablR's 1-of-3 minting multisig to add themselves as owner, replace the other owners and mint 8.35M USDR and 4.5M EURR, about $13.5M face value. They dumped about $10.4M of it on DEXs for ETH, with early net proceeds estimated at $2.8M, pushing USDR as low as $0.40 and EURR to about $0.85. ZachXBT said he helped freeze a six-figure sum."
  },
  {
   "slug": "resolv-usr-minting-key-compromise-mar-2026",
   "title": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026",
   "json": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "Resolv Labs USR stablecoin and holders",
   "tags": [
    "ethereum",
    "key-leak",
    "resolv",
    "usr",
    "stablecoin",
    "depeg",
    "private-key-compromise",
    "off-chain-signer",
    "minting"
   ],
   "amountUsd": 24500000,
   "victims": null,
   "startedAt": "2026-03-21",
   "closedAt": "2026-04-01",
   "updatedAt": "2026-04-01T12:00:00Z",
   "summary": "On 21 March 2026 an attacker obtained a privileged private key used by Resolv's off-chain minting service, deposited about $100K-$200K in USDC and minted about 80M USR, which the contracts did not cap. They swapped out for about 11,408 ETH, roughly $24.5M, and USR fell to about 26 cents. Resolv paused its app, offered the attacker a 10% bounty and asked holders not to trade USR while it works on recovery."
  }
 ],
 "changes": [
  {
   "incident": "address-poisoning-305k-dai-oct-2026",
   "incidentTitle": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-05",
   "title": "Incrypted published the addresses involved: the poison address matched the intended recipient's first three and last six hex characters.",
   "sourceUrl": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026"
  },
  {
   "incident": "address-poisoning-305k-dai-oct-2026",
   "incidentTitle": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-04",
   "title": "GoPlus Security reported the roughly $305,000 DAI loss and warned that address-poisoning campaigns are now fully automated.",
   "sourceUrl": "https://phemex.com/news/article/user-loses-305000-in-dai-to-automated-address-poisoning-attack-98744",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026"
  },
  {
   "incident": "stablr-1of3-multisig-key-may-2026",
   "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-24",
   "title": "StablR acknowledged an exploit on X about eight hours after on-chain activity stopped; Blockaid attributed it to one signer's compromised key on a 1-of-3 multisig.",
   "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026"
  },
  {
   "incident": "stablr-1of3-multisig-key-may-2026",
   "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-23",
   "title": "ZachXBT flagged the exploit at 9:46 PM ET after the attacker minted 8.35M USDR and 4.5M EURR through the minting multisig.",
   "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026"
  },
  {
   "incident": "resolv-usr-minting-key-compromise-mar-2026",
   "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "Halborn's March review attributed the roughly $23M loss to a compromised key of an off-chain service, with no on-chain check on mint amounts.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-march-2026",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026"
  },
  {
   "incident": "resolv-usr-minting-key-compromise-mar-2026",
   "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-23",
   "title": "Resolv temporarily paused its app and later enabled redemptions while contacting verified holders.",
   "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026"
  },
  {
   "incident": "resolv-usr-minting-key-compromise-mar-2026",
   "incidentTitle": "Resolv's USR stablecoin depegs after attacker uses a compromised signing key to mint 80M unbacked tokens",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-03-21",
   "title": "Using a stolen privileged signing key, the attacker deposited roughly $100K-$200K in USDC, minted about 80M unbacked USR and traded it for about 11,408 ETH; USR fell to about 26 cents.",
   "sourceUrl": "https://therecord.media/hacker-breaches-resolv-defi-25-million",
   "url": "https://drains.watch/i/resolv-usr-minting-key-compromise-mar-2026"
  }
 ]
}