Governance exploit drives 37% stablecoin depeg

TLDR

StablRs USDR stablecoin has fallen about 37% below its dollar peg after a governance exploit on its minting controls, with its euro token EURR also significantly depegged.

1. Attackers compromised a weak 1-of-3 multisig controlling StablRs minting, created millions of unbacked USDR and EURR, and dumped them on DEXs, driving USDR to about $0.63 and EURR roughly 2024% below peg.
2. The incident was a governance and key management failure, not a smart contract bug, and shows that MiCA-compliant, regulated stablecoins can still carry serious operational risk.
3. Contagion to major stablecoins looks limited so far, but users should treat governance design, reserve transparency, and communication practices as core risk checks for any stablecoin position.

Deep Dive

1. How The Exploit Depegged USDR And EURR

On 24 May 2026, European issuer StablR reported that attackers exploited its minting setup for USDR and EURR.

Reports say a single private key in a 1-of-3 multisig was compromised, letting the attacker add their own address, remove other signers, and gain full mint control. An estimated 8.35 million USDR and 4.5 million EURR were minted without backing and then dumped into thin decentralized exchange liquidity, netting roughly 1,115 ETH, around 2.8 million dollars, while nominally issuing about 10.4 million dollars of tokens.

As selling overwhelmed liquidity, EURR slid to around 0.85 dollars and USDR traded between roughly 0.40 and 0.64 dollars, with one detailed account noting a 37 percent depeg to about 0.63 dollars for USDR and about a 22 percent gap for EURR.

2. Governance Failure, Not Code Bug

Security firms and analysts describe this as a governance and key management failure rather than a smart contract vulnerability. The contracts behaved as configured, but the configuration itself was unsafe.

StablR marketed EURR and USDR as fully compliant with the European MiCA framework, with regulated reserves and proof of collateral. However, detailed postmortems highlight that MiCA focuses on reserves, licensing, and disclosures, while saying little about operational controls like multisig thresholds, hardware security modules, time locks, or rate limits on minting.

Commentary notes that this is at least the second recent stablecoin exploit driven by single-key or weak multisig designs, reinforcing that regulated does not automatically mean secure when it comes to admin authority over mint and burn.

3. Contagion Risk And What To Watch

Coverage so far indicates that the damage is concentrated in StablRs own tokens, with large stablecoins like USDT and USDC and the broader market not showing major contagion from this event.

For USDR and EURR holders, the key variables are whether StablR can credibly restore backing and trust. That would likely require new, up to date reserve attestations, a clear plan for dealing with unbacked supply, stronger mint governance, and consistent communication, none of which were fully in place at the time of early reports.

For builders and risk managers, postmortems recommend at least 2-of-3 or 3-of-5 multisig for critical functions, plus additional safeguards such as hardware security modules, multi party computation, and time delays on large mint operations, especially for anything marketed as a safe stablecoin.

Conclusion

The USDR and EURR depegs show that stablecoin risk is not just about reserves or regulation, but about who controls the mint keys and how those powers are constrained. A single compromised signer in a permissive multisig was enough to mint millions in unbacked tokens and shatter market confidence. For crypto users and protocols, careful scrutiny of governance, key management, and communication standards is essential before treating any stablecoin as cash equivalent.