EU stablecoin issuer freezes tokens after exploit

TLDR

A European stablecoin issuer, StablR, has frozen its USDR and EURR tokens after an exploit let an attacker mint unbacked coins, leaving both stablecoins undercollateralized.

1. StablR halted minting and redemptions after a wallet compromise allowed about $13.5 million in unbacked USDR and EURR to be created and partially cashed out.
2. The exploit broke MiCA-style 1:1 backing, with USDR nearly back to peg but EURR still trading far below its target value, directly impacting holders balances.
3. Regulators, exchanges, and auditors will now scrutinize EU stablecoin custody and multisig design, and users should watch for recovery plans, audits, and any token contract changes.

Deep Dive

1. What Happened In The Exploit

StablR, a Malta based issuer of USDR and EURR, reported that an attacker compromised a 1 of 3 multisignature Ethereum wallet, added their own address, removed legitimate signers, and then minted unbacked tokens.

According to incident reporting, the attacker created about $13.5 million worth of USDR and EURR and realized roughly $2.8 million by selling into thin DEX liquidity, after which StablR froze minting and redemptions and asked exchanges to halt trading for both assets.

This left USDR, with around $20 million market cap, briefly down as much as 50 percent before recovering close to its peg, while EURR, around $10 million, remained deeply depegged near $0.55 relative to its euro target, as detailed in the exploit coverage.

2. Why It Matters For Holders And MiCA

The attack immediately broke the MiCA requirement that asset referenced tokens maintain full 1:1 backing, because reserves did not increase to match the newly minted supply.

For users, that shows up as depegs and frozen redemptions. USDR is near parity again, but its backing is still being assessed, while EURR holders are sitting on large apparent losses so long as the token trades far below its intended euro value.

Technically, the root cause was a weak governance threshold, where control of a single key in a 1 of 3 multisig enabled full administrative control. That is a cautionary example for any stablecoin that advertises multisig security without robust signing rules and monitoring.

3. What To Watch Next

StablR has notified the Malta Financial Services Authority under MiCA and EU cyber rules and is working with external security firms and law enforcement on recovery and attribution.

Key next steps to monitor are:

1. Whether StablR can recapitalize reserves or claw back funds to restore full backing.
2. How and when redemptions reopen, especially for EURR.
3. Any contract upgrades that change mint, burn, or admin controls.

Broader EU stablecoin issuers may now face tighter expectations on multisig thresholds, real time monitoring of mint functions, and clearer disclosures about freeze and upgrade powers.

Conclusion

A relatively small EU stablecoin issuer has just shown how a single weak multisig design can cascade into undercollateralization, depegs, and frozen redemptions despite operating under a MiCA regime.

For crypto users, the lesson is that issuer transparency, key management, and collateral governance matter as much as the regulatory wrapper, and those details are what will decide which stablecoins remain trustworthy after stress events like this.