European stablecoin issuer StablR has suspended minting and redemption services for its USDR and EURR tokens after a cyber attack left the assets under collateral, according to a company statement.
Onchain researcher ZachXBT publicly flagged the exploit over the weekend, posting that two contracts linked to StablR’s USDR and EURR stablecoins appeared to be compromised.
The Malta-based company said it discovered “irregularities” in its systems after internal alarms triggered an investigation.
StablR froze token operations and asked exchanges to halt trading, deposits and withdrawals for both stablecoins while the company investigates the breach. USDR currently has a market cap of $20 million, while EURR has a market cap of $10 million, according to CoinGecko data.
StablR acknowledged that the circulating supply of USDR and EURR is “currently not fully supported at a 1:1 ratio” as required by the EU’s Markets in Crypto-Assets (MiCA) regulation.
The company said it plans to notify Malta’s financial regulator, the Malta Financial Services Authority, under the EU’s Digital Operational Resilience Act and MiCA reporting rules. External cyber security firms and law enforcement agencies are also involved.
Blockchain security firm GoPlus Security said the attack may stem from a weakness in StablR’s Ethereum multi-signature wallet setup.
The Minting wallet was configured with a 1-in-3 multi-signature threshold according to GoPlus. Any of three authorized owners could authorize transactions alone.
Researchers say the attackers compromised a single key, added themselves as an administrator, and removed the legitimate signers. They then minted about 8.35 million USDR and 4.5 million EURR, about $13.5 million in unbacked tokens for peg.
Thin liquidity on decentralized exchanges meant the attackers made about $2.8 million after offloading the newly minted supply.
StablR’s tokens briefly lost as much as 50% of their peg before starting to recover. The USDR is now at $0.994, while the EURR is at $0.548, well below the euro’s current value of $1.16.
Chief executive Gijs op de Weegh said the company is acting “with full transparency” while the investigation continues.
