Overview
- Blockaid detected an active exploit on StablR on Sunday when a compromised private key in a 1-of-3 minting multisig allowed an attacker to add themselves, remove other owners, and mint 8.35 million USDR plus 4.5 million EURR.
- The attacker sold minted tokens into thin decentralized exchange pools and converted roughly 1,115 ETH, about $2.8 million, even though the new supply had a face value near $10.4 million.
- Both stablecoins lost their pegs during the exploit, with EURR falling about 23% from $1.15 to roughly $0.88 and USDR dropping about 30% to near $0.70.
- Security firms emphasized this was a key-management and governance failure rather than a smart contract bug because the 1-of-3 threshold let a single compromised key give full minting control.
- The incident adds to a string of May attacks that often involve admin key compromise and raises the risk of tighter scrutiny by counterparties and regulators while on-chain teams continue to monitor movements and await an official StablR statement.