European stablecoin issuer StablR has suspended minting and redemption services for its USDR and EURR tokens after a cyberattack left the assets under-collateralized, according to a company statement.
Onchain investigator ZachXBT publicly flagged the exploit over the weekend, posting that two contracts tied to StablR’s USDR and EURR stablecoins appeared compromised.
The Malta-based firm said it detected “irregularities” in its systems after internal alerts triggered an investigation.
StablR froze token operations and asked exchanges to halt trading, deposits and withdrawals for both stablecoins while the company investigates the breach. USDR currently has a $20 million market capitalization, while EURR has a $10 million market cap, according to CoinGecko data.
StablR acknowledged that the circulating supply of USDR and EURR is “currently not fully backed at the 1:1 ratio” as required under the European Union’s Markets in Crypto-Assets (MiCA) regulation.
The company said it plans to notify Malta’s financial regulator, the Malta Financial Services Authority, under the EU’s Digital Operational Resilience Act and MiCA reporting rules. External cybersecurity firms and law enforcement agencies are also involved.
Blockchain security firm GoPlus Security said the attack may have stemmed from a weakness in StablR’s Ethereum multisignature wallet setup.
The minting wallet was configured with a 1-of-3 multisignature threshold, according to GoPlus. Any one of three authorized owners could approve transactions alone.
Researchers say the attackers compromised a single key, added themselves as an administrator and removed the legitimate signers. They then minted roughly 8.35 million USDR and 4.5 million EURR, about $13.5 million in unbacked tokens at peg.
Thin liquidity on decentralized exchanges meant the attackers netted roughly $2.8 million after offloading the freshly minted supply.
StablR’s tokens briefly lost as much as 50% of their peg before starting to recover. USDR is now at $0.994, while EURR is at $0.548, far below the euro’s current value of $1.16.
Chief Executive Officer Gijs op de Weegh said the company is acting “with full transparency” as the investigation continues.