Safe

Minted

Change

Gnosis

Malta-based regulated stablecoin issuer <a href="https://cryip.co/stablr-euro-exploit-mints-8-35m-usdr-4-5m-eurr-eurr-usdr-depeg/" rel="noopener noreferrer nofollow">StablR was hit</a> by a serious exploit on May 24, 2026. An attacker compromised one private key from a weakly configured 1-of-3 multisig wallet, gained full minting control, and created $13.5 million worth of unbacked USDR and EURR stablecoins.
The attacker dumped most of the tokens on DEXs, triggering sharp depegs:
<ul>
 <li>USDR crashed from $1.00 to as low as $0.40</li>
 <li>EURR fell from €1.00 to as low as $0.85 (roughly 15-20% depeg)</li>
 <li>Attacker extracted approximately $2.8 million (around 1,115 ETH)</li>
</ul>
This case is significant because StablR is a MiCA-compliant Electronic Money Institution with claimed 1:1 fiat backing and connections to Tether and Kraken.
<h2 id="detailed-technical-analysis">Detailed Technical Analysis:</h2>
Combination of poor multisig design (threshold = 1) and private key compromise. This was not a vulnerability in the token smart contracts, but a total administrative takeover of the minting authority.
<h3 id="multisig-configuration-details">Multisig Configuration Details</h3>
<ul>
 <li>Multisig Contract Address: 0xF45392bd2D6e6b8C5Dc26BA6c8a12889419B82F3</li>
 <li>Threshold: 1/3 : This made the entire setup as secure as a single signature wallet for critical actions.</li>
 <li>Compromised Owner: 0xC73fD562de86d7860EE636C20813Bcb2cF4D550d (private key stolen)</li>
</ul>
<h2 id="step-by-step-attack-breakdown">Step-by-Step Attack Breakdown</h2>
<h3 id="key-compromise-initial-access">Key Compromise &amp; Initial Access</h3>
The attacker stole the private key of Owner 0xC73f…550d. Using this key, they immediately added their malicious address 0xD4677B5A8B1b97EA213Fdb876b0FcBAB3f9F6CD1 as a new owner of the multisig.
<h3 id="full-ownership-takeover">Full Ownership Takeover</h3>
The attacker then systematically removed legitimate owners:
<ul>
 <li>Replaced 0xD4b6543504Df90Faba649B80F8f669CafFe0aD40 with 0xbC631Daf86611f32FAA63E7EC8c9c9571F2F5BB3</li>
 <li>Replaced the original compromised owner 0xC73f…550d with 0x482aC1a69A41e7657DE6B420B7346FB09DA09115</li>
</ul>
Critical Ownership Change Transactions:
<ul>
 <li>Tx 1:<a href="https://etherscan.io/tx/0x1f8a6764f66bb5a2438dc62f89bfe52080dbca782444c3757dbf1e1ce3a11bec" rel="noopener noreferrer nofollow">0x1f8a6764f66bb5a2438dc62f89bfe52080dbca782444c3757dbf1e1ce3a11bec</a></li>
 <li>Tx 2:<a href="https://etherscan.io/tx/0xde5bc3b7b80576f894fbc7e2c8fea5f8829503bae75dcf30a27725cd95a05f16" rel="noopener noreferrer nofollow">0xde5bc3b7b80576f894fbc7e2c8fea5f8829503bae75dcf30a27725cd95a05f16</a></li>
</ul>
After these changes, the attacker had 100% control over the multisig.
<h3 id="unlimited-minting">Unlimited Minting</h3>
Using the now-controlled multisig, the attacker called the mint function multiple times through address 0xD467…6CD1.
Minted Amounts:
<ul>
 <li>8.35 million USDR</li>
 <li>4.5 million EURR</li>
</ul>
Example Mint Transaction:<a href="https://etherscan.io/tx/0xa7209051302ad08590af257c9252b80298a857cf8ee4a3d9779eb0f6520b24ed" rel="noopener noreferrer nofollow"> 0xa720…24ed</a>
<h2 id="token-dumping-profit-taking">Token Dumping &amp; Profit Taking</h2>
The freshly minted tokens were swapped on DEXs (primarily Uniswap) for ETH. Due to low liquidity, they sold at a heavy discount, but still walked away with ~$2.8M.
<h4>Affected Contracts</h4>
<ul>
 <li>USDR Token: 0x7B43E3875440B44613DC3bC08E7763e6Da63C8f8</li>
 <li>EURR Token: 0x50753CfAf86c094925Bf976f218D043f8791e408</li>
</ul>
Both contracts were functioning normally. The exploit only abused the admin privileges.
<h4>Attacker Addresses (Tracked)</h4>
<ul>
 <li>Primary Attacker: 0xD4677B5A8B1b97EA213Fdb876b0FcBAB3f9F6CD1</li>
 <li>Secondary: 0x482aC1a69A41e7657DE6B420B7346FB09DA09115</li>
 <li>Tertiary: 0xbC631Daf86611f32FAA63E7EC8c9c9571F2F5BB3</li>
</ul>
Additional Insights &amp; Impact Analysis
<ul>
 <li>Depeg Dynamics: The sudden supply increase without collateral caused immediate panic selling. Thin liquidity pools on DEXs amplified the price crash through high slippage.</li>
 <li>Regulatory Angle: Even though StablR is MiCA licensed, this shows that regulatory compliance does not automatically protect against bad technical setups.</li>
 <li>Response: StablR and security teams (including ZachXBT) are actively tracking the funds. Some freezing actions may have been taken.</li>
</ul>
<h2 id="key-technical-lessons-recommendations">Key Technical Lessons &amp; Recommendations</h2>
<ol>
 <li>Never use 1 of N multisig for high privilege functions like stablecoin minting.</li>
 <li>Minimum standard: 2 of 3 or 3 of 5 with hardware wallets and geographic distribution.</li>
 <li>Use battle tested solutions like Gnosis Safe with timelock modules and transaction delays.</li>
 <li>Implement role separation minting, ownership changes, and pausing should have different controls.</li>
 <li>Regular monitoring of ownership events and automated alerts for any multisig changes.</li>
 <li>Consider MPC wallets or institutional custody solutions for better security.</li>
</ol>
This exploit is a perfect example of how one weak link (a single private key + bad threshold) can compromise an entire stablecoin system, regardless of regulation.

StablR Stablecoin Exploit: Full Technical Analysis of the $13.5M Multisig Attack

Table of Contents

CRYIP

Other articles published on May 25, 2026

Join our free newsletter for daily crypto updates!