Stablecoin depegs 37% after $10M exploit

TLDR

A governance exploit at stablecoin issuer StablR caused its USDR token to depeg by about 37% after an attacker minted millions in unbacked coins.

1. StablR USD (USDR) and euro stablecoin EURR lost their pegs after an attacker hijacked a weak 1-of-3 multisig that controlled minting.
2. The attacker minted roughly $10.4 million of unbacked USDR and EURR but only extracted about $2.8 million in crypto, with USDR trading as low as about $0.40 to $0.63.
3. The incident highlights that key management and governance can be as dangerous as smart contract bugs and underlines higher risk in smaller, newer stablecoins.

Deep Dive

1. What Actually Happened

Reports say Malta based issuer StablR suffered a security incident where an attacker compromised one private key in a 1-of-3 multisig that controlled stablecoin minting on Ethereum.

With that single key, the attacker added their own address as owner, removed legitimate signers, and minted about 8.35 million USDR and 4.5 million EURR, face value around $10.4 million at peg, according to multiple writeups including this detailed summary.

Security firm Blockaid and others stressed this was not a smart contract bug but a key management and governance failure in the minting setup.

2. How Bad The Depeg Is

Once the unbacked tokens were minted, the attacker dumped them into relatively thin DEX liquidity pools, which collapsed prices.

Coverage notes EURR traded around $0.85, down roughly 20 to 24%, while USDR traded between about $0.40 and $0.64, roughly a 30 to 37% depeg from its dollar target, as described in this report.

Due to slippage, the attacker realized only around 1,115 ETH, about $2.8 million, far below the nominal $10.4 million they had minted, highlighting how illiquid stablecoin pools can amplify losses for both issuers and holders.

3. Broader Stablecoin And User Lessons

StablR markets its tokens as MiCA compliant and regulated, yet the exploit came from operational controls, not code, which critics see as a gap in how regulation handles key management.

So far there are no reports of contagion to major stablecoins such as USDT or USDC, but the event fits a 2026 pattern of exploits caused by compromised admin keys rather than protocol logic, as other analyses like this overview emphasize.

For users, key risk factors to monitor in any stablecoin include: who controls minting and burning, multisig thresholds, timelocks or rate limits, transparency of reserves, communication during incidents, and depth of on-chain liquidity.

Conclusion

The StablR exploit shows a regulated, audited label does not guarantee operational safety if minting controls are weak. A single compromised key led to massive unauthorized issuance and a sharp depeg. For crypto users, governance design, key management, and real liquidity are as important as reserve claims when judging which stablecoins to hold or use.