An ongoing exploit is impacting StablR, resulting in the depeg of its Euro and USD stablecoins, while a compromised private key has been blamed, adding to a lengthening list of hacks and exploits this month.
Blockchain security firm Blockaid reported on Sunday that its exploit detection system has identified an ongoing exploit on the StablR issuer, with around $2.8 million extracted so far.
The suspected cause is a private key compromise of one owner in the minting multisignature account, which used a weak 1-of-3 threshold, stated Blockaid.
The attacker added themselves, replaced the other owners, and minted 8.35 million USDR and 4.5 million EURR, causing the stablecoins to depeg.
The attacker then swapped the minted tokens worth around $10.4 million on decentralized exchanges for just 1,115 ETH or around $2.8 million due to thin liquidity.
“This is not a smart contract bug — it’s a key management and governance failure,” said Blockaid.
May has been a bad month for crypto and DeFi exploits with over a dozen major incidents so far, according to DeFiLlama. Some of the larger ones included THORChain, Verus Bridge, Echo Protocol and Polymarket.
StablR euro and dollar stablecoins depeg
StablR’s euro stablecoin, EURR, which has a $14 million market capitalization, lost 23% of its value, which depegged the asset from its $1.15 peg to $0.88 in EUR/USD markets, according to CoinGecko.
Meanwhile, StablR’s USDR dollar stablecoin, with an $11 million market capitalization, tanked 30% to $0.70 in the ongoing incident on Sunday morning.
Related: Map Protocol token plummets 96% after a quadrillion token mint exploit
StablR issues regulated collateralized stablecoins pegged to the Euro and USD, with reserves held in segregated accounts at top-tier institutions. They emphasize regulatory compliance, transparency via proof-of-reserves and availability on Ethereum and Solana.
The world’s largest stablecoin issuer, Tether, invested in StablR in December 2024.
There were no updates on the StablR X feed at the time of writing.
EURR depegs 23%. Source: Peckshield
DeFi exploits continue to mount
Compromised private keys are becoming a common attack vector, with several DeFi protocols being exploited as a result of poor management recently.
Volo Vault, Wasabi Perps, Echo Bridge and Polymarket were all hit with private or admin key exploits over the past two months.
Meanwhile, the Bitcoin cross-chain bridge Map Protocol was exploited by a smart contract bug on Wednesday, May 21, when an attacker minted a quadrillion MAPO tokens.
Magazine: DeFi’s billion-dollar secret: The insiders responsible for hacks