StablR hack — May 2026

StablR, a Malta-authorised issuer of the euro stablecoin EURR and the dollar stablecoin USDR, identified unauthorised external access to its platform infrastructure on Sunday 24 May 2026 and disclosed it publicly the following day. In its own statement the company said it had identified irregularities after receiving alerts, suspended all token minting and redemption activity, asked exchanges and trading venues to halt trading, deposits and withdrawals, and engaged external forensic specialists. It confirmed that the circulating supply of both tokens was not fully backed at the 1:1 ratio required under MiCAR, and said it was notifying the Malta Financial Services Authority of a Major ICT-Related Incident under DORA.

Security firm Blockaid attributed the incident to compromise of a single owner key on the multisig wallet used for minting. CoinDesk, citing GoPlus, reports that wallet was configured with a 1-of-3 threshold, so any one of three authorised owners could approve alone. On Blockaid's account, reported by Cointelegraph, the attacker added their own address as an owner, removed the legitimate signers, then minted about 8.35 million USDR and 4.5 million EURR on Ethereum and sold them into decentralised exchange liquidity for roughly 1,115 ETH, about $2.8 million.

The headline figures in circulation measure different things. The attacker realised roughly $2.8 million, consistent across Cointelegraph and CoinDesk, the gap against face value reflecting heavy slippage in thin pools. The unbacked supply created was larger: Cointelegraph put it near $10.4 million, while CoinDesk reported about $13.5 million at peg. This record uses the realised proceeds as the headline amount and carries the unbacked-supply figure as the upper bound. Both tokens broke their pegs, with CoinDesk quoting USDR at $0.994 and EURR at $0.548 against a euro reference of $1.16.

In a follow-up on 5 June 2026 StablR said the safeguarded reserve assets held before the incident remained segregated from company funds, that minting and redemption were still suspended, and that it was engaging with authorities. It warned holders about third parties offering paid expedited redemption.