StablR has frozen its stablecoins USDR and EURR after an attacker exploited a weakness in the project’s 1-of-3 multisig wallet to mint $13.5 million in unbacked tokens. The attacker compromised a single key and created the tokens, though the actual net gain was $2.8 million, suggesting StablR’s freeze may have limited the damage but not fully prevented losses.
How the attack worked
The exploit targeted the multisig wallet that controls token minting. Unlike a standard setup requiring multiple signatures, StablR’s configuration allowed a single compromised key to authorize new token creation. That gave the attacker the ability to mint $13.5 million worth of USDR and EURR without backing reserves.
Blockchain data shows the attacker used the stolen key to generate the tokens in a single transaction. The minted tokens were then moved and partially cashed out before StablR could react. The net extraction of $2.8 million indicates that the attacker converted some of the unbacked tokens into other assets or off-ramped them.
StablR’s response
After discovering the breach, StablR froze both stablecoins, preventing further movement of the remaining minted tokens. The freeze applies to the $13.5 million in unbacked tokens, but the $2.8 million already taken is likely beyond recovery. The company has not disclosed whether it will attempt to claw back those funds or reimburse affected users.
The incident highlights a known risk of multisig wallets with low threshold requirements. Security experts have long warned that a 1-of-3 setup offers little protection if a single key is exposed. StablR has not commented on whether it will upgrade its security architecture.
What’s next for the stablecoins
USDR and EURR remain frozen. StablR has not set a date for unfreezing them or announced a plan for redeeming the legitimate tokens. Users holding the stablecoins are stuck until the company resolves the situation. The regulator or investigators may also step in, though no official action has been reported.
The lingering question is how StablR will address the $2.8 million gap. If reserves are insufficient, the stablecoins could lose their peg permanently, damaging trust in the project. For now, the freeze buys time, but it doesn’t solve the underlying shortfall.
