MiCA euro stablecoin depegs after wallet exploit

TLDR

A MiCA regulated euro stablecoin from StablR has sharply depegged after its minting wallet was taken over via a key compromise.

1. StablR Euro (EURR) and StablR USD (USDR) depegged after an attacker abused a weak 1-of-3 multisig to mint about $10.4 million in unbacked tokens and dump them on DEXs.
2. EURR traded around $0.85 and USDR as low as $0.40 to $0.70, showing that MiCA style regulation did not prevent a governance and key management failure.
3. Impact looks contained to StablR for now, but holders face high uncertainty until a recovery plan appears and regulators may push for stricter operational controls on European stablecoin issuers.

Deep Dive

1. What Actually Happened

Malta based issuer StablR, which promotes its EURR euro stablecoin as MiCA compliant, suffered a critical exploit in its minting setup. Reports say the attacker compromised a single private key in a 1-of-3 multisig that controlled issuance.

According to onchain analysis summarized by The Block and others, the attacker added their own address, removed legitimate signers, then minted about 8.35 million USDR and 4.5 million EURR, roughly $10.4 million at par, and swapped them for around 1,115 ETH, about $2.8 million, on thin DEX liquidity pools covered here.

Security firm Blockaid and multiple outlets stress this was not a smart contract bug but an administrative failure in the minting multisig and key management described as a governance failure.

2. How Bad The Depeg Is

Once the unbacked tokens hit DEXs, prices collapsed. Coverage from Bitcoin.com notes EURR fell to about $0.85, roughly 20 to 26 percent below its intended euro peg, while USDR traded between $0.40 and $0.64 in some pools after the exploit.

Cointelegraph similarly reports EURR dropping from around $1.15 to the high $0.80s and USDR sliding to roughly $0.70, with market caps in the low tens of millions and thin on chain liquidity magnifying slippage in its recap.

Major stablecoins like USDT and USDC have not been affected in these reports, and euro stablecoins remain a tiny slice of overall stablecoin supply, so systemic contagion looks limited for now.

3. MiCA, Trust, And What To Watch

StablR operates as a licensed Electronic Money Institution in Malta and markets EURR as MiCA aligned, with proof of reserves and regulated backing. The exploit shows that regulatory status did not automatically enforce robust multisig thresholds, timelocks, or operational key security.

Commentary around the hack frames it as a wake up call for regulators, auditors, and users: MiCA covers disclosures and backing, but exploitable governance around minting can still destroy confidence in a supposedly conservative asset.

Key things to watch next:

1. Whether StablR publishes a detailed post mortem and concrete remediation, including new multisig design and key custody.
2. Any commitment to redeem depegged tokens at par using off chain reserves, or to burn attacker minted supply.
3. Follow up from European regulators on operational standards for MiCA stablecoins after a MiCA branded product suffered this type of failure.

Conclusion

A MiCA compliant label and an EMI license did not stop StablRs euro stablecoin from depegging once a single minting key was compromised, revealing a gap between regulation and operational security. The damage appears contained to EURR and USDR, but trust in smaller regulated stablecoins has taken a hit, and the episode is likely to accelerate demands for stricter multisig and key management standards across European issuers.