StablR (EURR + USDR) — 1-of-3 Minting Multisig Key Compromise

Timeline: Late on 23 May into 24 May 2026, an attacker who compromised a single signer key on StablR's 1-of-3 minting multisig added themselves as an owner, removed the two legitimate signers, and minted roughly $13.5M of unbacked stablecoins (about 8,350,000 USDR and 4,500,000 EURR). The tokens were dumped on Uniswap V3, where thin liquidity meant the attacker realised only about $2.8M (~1,115 ETH) of the $13.5M nominal mint. ZachXBT flagged the attack publicly at ~01:46 UTC on 24 May, publishing the attacker wallet and a CCTP-on-Noble funding link, and coordinated a partial freeze. StablR issued a statement around 12:10 UTC on 24 May and, by 26 May, suspended minting and redemption, notified Malta's MFSA under MiCA/DORA, and engaged external cybersecurity firms and law enforcement. EURR depegged severely (to roughly $0.55-0.86 intraday) while USDR recovered toward $0.994 by 26-27 May. Blockaid and GoPlus attributed the incident to a key-management and governance failure rather than a smart-contract bug. StablR holds an Electronic Money Institution license from the MFSA (July 2024) and had taken strategic investment from Tether (Dec 2024) and Kraken (July 2025). No user compensation had been announced as of the cutoff, and recovery beyond the partial freeze was 0%.