Attacker compromised a 1-of-3 multisig signer key for StablR's minting contract, minted 8.35M unbacked USDR and 4.5M EURR, and dumped them on DEXes for ~1,115 ETH, realizing ~$2.8M profit.
On July 12, 2026, an attacker compromised a 1-of-3 multisig signer key for StablR's minting contract and minted 8.35M unbacked USDR and 4.5M EURR (combined face value ~$13.5M). The attacker dumped the unbacked stablecoins on DEXes for approximately 1,115 ETH, realizing ~$2.8M in profit. Both EURR and USDR stablecoins depegged following the attack. StablR is a Malta-licensed MiCA-compliant EMI backed by Tether. The root cause was a governance failure (single key compromise), not a smart contract bug.
Minted USDR and EURR swapped on DEXes for ~1,115 ETH. Attacker address: 0xea480c23d7b29a515856aafe0dc86f7519965a04. No recovery reported at time of writing.
0xea480c23d7b29a515856aafe0dc86f7519965a04