{"investigation":{"slug":"stablr-multisig-exploit-and-eurr-usdr-depeg","entity_name":"StablR — Multisig Exploit and EURR/USDR Depeg","trust_score":21,"severity_base":null,"score_modifier":-7,"confidence":0.82,"status":"published","content_type":"investigation","summary":"On May 24, 2026, an attacker compromised one signer of StablR's 1-of-3 minting multisig and used the resulting administrator access to mint roughly $13.5 million in unbacked EURR and USDR tokens, which were sold on decentralized exchanges and caused both euro- and dollar-pegged stablecoins to depeg sharply. StablR suspended minting and redemption that day and, three months later, confirmed in a regulatory notification that more than 20 million unbacked token units remained in circulation with no redemption timetable. The incident compounded pre-existing scrutiny of StablR's management, several of whom previously ran the payments firm Payvision, which Dutch authorities fined over anti-money-laundering failures.","sections":[{"content":"On May 24, 2026, an attacker gained control of StablR's minting infrastructure for its EURR (euro-pegged) and USDR (dollar-pegged) stablecoins. Blockchain security firm Blockaid attributed the breach to the compromise of a private key belonging to one signer on a minting multisig that required only one of three signatures to authorize actions (a 1-of-3 threshold), characterizing it as a key-management and governance failure rather than a smart-contract code flaw. Using the compromised access, the attacker added themselves as an administrator, replaced the multisig's existing owners, and minted approximately 8.35 million USDR and 4.5 million EURR, together valued at roughly $13.5 million at face value. The attacker swapped about $10.4 million in face value of the minted tokens for ETH across decentralized exchanges; thin liquidity meant realized proceeds were initially estimated at around $2.8 million, though a consolidation wallet later tagged by Etherscan as \"StablR Exploiter 2\" held 1,488 ETH (roughly $3.1–3.15 million at the time), suggesting actual proceeds were somewhat higher than the first estimate. The attacker also used administrator powers to blacklist and burn tokens held by at least one legitimate counterparty undergoing routine redemption, destroying about 2.7 million EURR (roughly $2.4 million) that belonged to a third party. On-chain investigator ZachXBT publicly flagged the exploit at 9:46 PM ET and said he helped freeze a six-figure sum of the stolen funds by around 11:52 PM ET while the attack was still underway; he also said StablR's team appeared unresponsive for several hours. StablR itself acknowledged the exploit on X at about 8:10 AM ET, roughly eight hours after on-chain activity on the affected contracts had stopped. Because most of the attacker's proceeds were swapped into ETH rather than held in fiat-linked tokens StablR could freeze directly, the bulk of the funds were not recoverable through centralized freezing, though reporting confirms a partial, six-figure freeze occurred during the incident with the help of ZachXBT and at least one exchange's compliance team.","heading":"The May 2026 Multisig Exploit","sources":[{"url":"https://www.theblock.co/amp/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit","name":"The Block: \"StablR's EURR and USDR depeg after attacker mints $13.5 million in unbacked tokens through multisig exploit\"","type":"news_article","credibility":2},{"url":"https://www.crowdfundinsider.com/2026/05/281637-stablr-eurr-and-usdr-stablecoins-break-peg-following-multisig-compromise-and-unauthorized-token-creation/","name":"Crowdfund Insider: \"StablR EURR and USDR Stablecoins Break Peg Following Multisig Compromise and Unauthorized Token Creation\"","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/zachxbt-says-stablr-linked-contracts-hacked/","name":"Cryptopolitan: \"ZachXBT says StablR-linked contracts hacked\"","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Following the mass sale of unbacked tokens, both EURR and USDR lost their pegs. The Block reported EURR fell to a low of $0.85, which it described as a roughly 26% decline from an expected value near $1.15 given prevailing EUR/USD exchange rates (EUR/USD traded in a roughly 1.16–1.18 range through most of May 2026, per historical exchange-rate data, rather than the 1.08 figure a prior version of this page used). USDR's reported low varies by source and by moment: The Block's own reporting is internally inconsistent, citing both a $0.40 intraday low and a $0.64 price at time of publication (roughly a 36% decline from $1.00), while other outlets reported declines in the 23–30% range and at least one later report described USDR as briefly depegging before recovering to about $0.994 and EURR falling only to about $0.548. These figures are not fully reconcilable from public reporting and should be treated as approximate; the lower-confidence secondary figures do not contradict the broader picture of a severe, briefly double-digit-to-majority depeg in both tokens. Multiple exchanges, including Kraken, paused deposits and withdrawals of EURR and USDR on May 24, 2026, citing the exploit, though Kraken stated there was no indication its own systems were compromised.","heading":"EURR/USDR Depeg and Market Impact","sources":[{"url":"https://www.theblock.co/amp/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit","name":"The Block: \"StablR's EURR and USDR depeg after attacker mints $13.5 million in unbacked tokens through multisig exploit\"","type":"news_article","credibility":2},{"url":"https://www.valutafx.com/history/eur-usd-2026-05-13","name":"ValutaFX: Euro to US Dollar historical exchange rate, May 2026","type":"research","credibility":2},{"url":"https://bitcoinworld.co.in/stablr-halts-usdr-eurr-services-following-13-5-million-exploit/","name":"Bitcoin World: \"StablR Halts USDR, EURR Services Following $13.5 Million Exploit\"","type":"news_article","credibility":3}],"severity":"high"},{"content":"StablR suspended minting and redemption of EURR and USDR on the day of the exploit, May 24, 2026, and acknowledged that circulating tokens were no longer fully backed at the 1:1 ratio required for e-money token issuers under the EU's Markets in Crypto-Assets regulation (MiCAR). The suspension continued for three months with no public timetable for resumption. On August 25, 2026, StablR published what advocacy group EFRI described as its most detailed notification to date, disclosing — for the first time in quantified terms — that approximately 6.41 million EURR and 14.33 million USDR of unauthorized tokens (more than 20 million units combined) remained in circulation, created without corresponding payment and not backed by reserve assets. The notification came one day after EFRI, on August 24, 2026, submitted a renewed supervisory request to the Malta Financial Services Authority (MFSA), copied to the European Banking Authority, asking it to clarify the legal basis for the continued redemption suspension under MiCAR Articles 46, 47 and 49, whether StablR's EURR white paper required amendment, and how ICT and licensing responsibilities were allocated between StablR and its Netherlands-based technology affiliate. EFRI noted that the one-day gap between its request and StablR's disclosure does not establish that the submission prompted the disclosure. As of EFRI's reporting (August 28, 2026), StablR's website still described EURR and USDR as \"fully collateralized\" and redeemable at par, which EFRI characterized as inconsistent with the disclosed shortfall and ongoing suspension. No public response from the MFSA confirming or resolving these questions was identified in subsequent reporting, and no coverage after August 2026 was found describing resumption of redemption or minting.","heading":"Regulatory Notification and Ongoing Suspension","sources":[{"url":"https://efri.io/stablr-discloses-scale-of-unbacked-tokens-one-day-after-efri-renewed-its-mfsa-request/","name":"EFRI: \"StablR discloses scale of unbacked tokens one day after EFRI renewed its MFSA request\"","type":"community_report","credibility":2},{"url":"https://bitcoinworld.co.in/stablr-halts-usdr-eurr-services-following-13-5-million-exploit/","name":"Bit2Me status page / coverage of StablR suspension","type":"news_article","credibility":3}],"severity":"high"},{"content":"StablR Ltd. was incorporated in Malta in December 2022 by Dutch holding company Plutus B.V. and received an Electronic Money Institution (EMI) license from the MFSA under MiCA Title IV in 2024 (reported variously as June or July 2024 by different sources), allowing it to issue EURR. The company is run by Gijs op de Weegh and Corne van der Meijden, both former executives of Payvision B.V., a Dutch payments processor acquired by ING in 2018 and shut down in 2021. Advocacy group EFRI, which represents consumers who say they lost more than €20 million in investment scams run by Gal Barak and Uwe Lenhoff, alleges that Payvision processed roughly €150 million in payments for those and related schemes by ignoring anti-money-laundering red flags, and that op de Weegh personally signed merchant agreements with Barak-linked shell companies, including a contract with a company called GPay in July 2018 despite prior UK FCA warnings. In April 2024, the Dutch Public Prosecution Service settled AML-failure cases against two former Payvision directors by penalty order following a Dutch central bank (DNB) referral; trade publication Vixio confirmed the settlement and total fines but did not name which director received which amount in its own text. FinTelegram, an outlet that has run a sustained critical campaign against StablR and Payvision's legacy, attributes the fines as €180,000 to Rudolf Booker and €150,000 to Cheng Liem Li, covering inadequate customer due diligence between 2016 and April 2020. Op de Weegh himself was not prosecuted in that matter. EFRI first petitioned the MFSA to reassess StablR's EMI license over this history on July 8, 2025, and has since renewed that request at least twice, including after the May 2026 exploit. These allegations about op de Weegh's personal conduct and about the adequacy of the Dutch settlement come primarily from EFRI and FinTelegram, both of which are openly critical, advocacy-oriented sources; the AML enforcement action itself, and the identities of the two fined Payvision directors, are corroborated by trade-press reporting, but the specific fine-to-individual attribution rests on FinTelegram alone and should be treated with correspondingly lower confidence.","heading":"Pre-Existing Governance Concerns: Management's Payvision History","sources":[{"url":"https://www.vixio.com/insights/pc-former-payvision-execs-fined-aml-failures","name":"Vixio: \"Former Payvision Execs Fined For AML Failures\"","type":"news_article","credibility":2},{"url":"https://fintelegram.com/efri-goes-after-stablrs-malta-licence-will-krakens-new-stake-survive-the-aml-storm/","name":"FinTelegram: \"EFRI Goes After StablR's Malta Licence — Will Kraken's New Stake Survive the AML Storm?\"","type":"community_report","credibility":3},{"url":"https://fintelegram.com/payvision-scandal-dutch-authorities-cover-up-fraud-former-coo-now-runs-regulated-stablecoin-provider/","name":"FinTelegram: \"Payvision Scandal: Dutch Authorities Cover Up Fraud, Former COO Now Runs Regulated Stablecoin Provider\"","type":"community_report","credibility":3},{"url":"https://efri.io/efri-urges-mfsa-to-review-stablrs-emi-license/","name":"EFRI: \"EFRI Urges MFSA to Review StablR's EMI License\"","type":"community_report","credibility":2}],"severity":"medium"},{"content":"Despite the governance concerns raised above, StablR secured notable institutional backing before the May 2026 exploit. Tether announced an equity investment in StablR on December 17, 2024, to support stablecoin adoption in Europe ahead of MiCA's December 30, 2024 implementation deadline, and StablR separately announced a strategic investment from crypto exchange Kraken around July 21, 2025, which it said accompanied listing of EURR and USDR on 50+ exchanges and roughly $3 billion in 2025 transaction volume. Neither company disclosed the size of its stake, and no outlet identified in this research obtained the original press release terms independently of StablR's and Tether's own announcements. FinTelegram has separately reported, based on StablR's own proof-of-reserves disclosures, a quarter-on-quarter decline in EUR reserves and EURR circulation in the quarter preceding the exploit; this single-source financial analysis has not been independently corroborated and is treated here as low-confidence context rather than a verified finding.","heading":"Institutional Backing Context","sources":[{"url":"https://tether.io/news/tether-invests-in-stablr-to-promote-stablecoin-adoption-in-europe/","name":"Tether: \"Tether Invests In StablR To Promote Stablecoin Adoption In Europe\"","type":"official","credibility":2},{"url":"https://fintelegram.com/the-stablr-paradox-when-strategic-investments-fail-to-drive-growth-a-framework-for-analyzing-small-stablecoin-issuer-viability/","name":"FinTelegram: \"The StablR Paradox: When Strategic Investments Fail to Drive Growth\"","type":"community_report","credibility":3}],"severity":"low"}],"timeline":[{"date":"2022-12","event":"StablR Ltd. incorporated in Malta by Dutch holding company Plutus B.V.","source":"EFRI","source_url":"https://efri.io/efri-urges-mfsa-to-review-stablrs-emi-license/"},{"date":"2024","event":"StablR receives an Electronic Money Institution license from the MFSA under MiCA Title IV, allowing issuance of EURR (sources differ on whether this occurred in June or July 2024)","source":"EFRI / Tether","source_url":"https://tether.io/news/tether-invests-in-stablr-to-promote-stablecoin-adoption-in-europe/"},{"date":"2024-04","event":"Dutch Public Prosecution Service settles AML-failure cases against two former Payvision directors (reported by FinTelegram as Rudolf Booker, €180,000, and Cheng Liem Li, €150,000) by penalty order, covering inadequate due diligence from 2016 to April 2020","source":"Vixio","source_url":"https://www.vixio.com/insights/pc-former-payvision-execs-fined-aml-failures"},{"date":"2024-12-17","event":"Tether announces an equity investment in StablR","source":"Tether","source_url":"https://tether.io/news/tether-invests-in-stablr-to-promote-stablecoin-adoption-in-europe/","date_evidence":"Tether \"has invested in StablR, the European stablecoin provider\"; article dated December 17, 2024"},{"date":"2025-07","event":"EFRI sends a letter to the MFSA, copied to the EBA, urging it to urgently reassess StablR's EMI license over undisclosed Payvision-linked AML concerns","source":"EFRI","source_url":"https://efri.io/efri-urges-mfsa-to-review-stablrs-emi-license/","date_original":"2025-07-08"},{"date":"2025-07","event":"StablR announces a strategic investment from Kraken, around July 21, 2025 per secondary reporting","source":"FinTelegram / CB Insights","source_url":"https://fintelegram.com/efri-goes-after-stablrs-malta-licence-will-krakens-new-stake-survive-the-aml-storm/"},{"date":"2026-05","event":"Attacker compromises a signer of StablR's 1-of-3 minting multisig, mints ~$13.5 million in unbacked EURR and USDR, and sells tokens on DEXs; StablR suspends minting and redemption of both tokens","source":"The Block / EFRI","source_url":"https://www.theblock.co/amp/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit","date_evidence":"\"The submission followed the cyber incident of 24 May, after which StablR suspended minting and redemption\"","date_original":"2026-05-24"},{"date":"2026-08-24","event":"EFRI submits a renewed supervisory request to the MFSA concerning StablR's licensing and the handling of the May 2026 incident","source":"EFRI","source_url":"https://efri.io/stablr-discloses-scale-of-unbacked-tokens-one-day-after-efri-renewed-its-mfsa-request/","date_evidence":"\"On 24 August 2026, EFRI submitted a renewed supervisory request\""},{"date":"2026-08","event":"StablR publicly quantifies for the first time that more than 20 million unbacked EURR/USDR units remain in circulation, with redemption still suspended and no resumption timetable","source":"EFRI","source_url":"https://efri.io/stablr-discloses-scale-of-unbacked-tokens-one-day-after-efri-renewed-its-mfsa-request/","date_evidence":"\"On 25 August, StablR published its most detailed notification to date\"","date_original":"2026-08-25"}],"sources_used":[{"url":"https://www.theblock.co/amp/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit","name":"The Block: \"StablR's EURR and USDR depeg after attacker mints $13.5 million in unbacked tokens through multisig exploit\"","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.crowdfundinsider.com/2026/05/281637-stablr-eurr-and-usdr-stablecoins-break-peg-following-multisig-compromise-and-unauthorized-token-creation/","name":"Crowdfund Insider: \"StablR EURR and USDR Stablecoins Break Peg Following Multisig Compromise and Unauthorized Token Creation\"","type":"news_article","archive_url":"http://web.archive.org/web/20260924031922/https://www.crowdfundinsider.com/2026/05/281637-stablr-eurr-and-usdr-stablecoins-break-peg-following-multisig-compromise-and-unauthorized-token-creation/","credibility":2,"archive_timestamp":"2026-09-24T03:19:22+00:00"},{"url":"https://www.cryptopolitan.com/zachxbt-says-stablr-linked-contracts-hacked/","name":"Cryptopolitan: \"ZachXBT says StablR-linked contracts hacked\"","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://bitcoinworld.co.in/stablr-halts-usdr-eurr-services-following-13-5-million-exploit/","name":"Bitcoin World: \"StablR Halts USDR, EURR Services Following $13.5 Million Exploit\"","type":"news_article","archive_url":"http://web.archive.org/web/20260725140538/https://bitcoinworld.co.in/stablr-halts-usdr-eurr-services-following-13-5-million-exploit/","credibility":3,"archive_timestamp":"2026-07-25T14:05:38+00:00"},{"url":"https://www.valutafx.com/history/eur-usd-2026-05-13","name":"ValutaFX: Euro to US Dollar historical exchange rate, May 2026","type":"research","archive_url":"https://web.archive.org/web/20261108111025/https://www.valutafx.com/history/eur-usd-2026-05-13","credibility":2,"archive_timestamp":"2026-11-08T11:10:25+00:00"},{"url":"https://efri.io/stablr-discloses-scale-of-unbacked-tokens-one-day-after-efri-renewed-its-mfsa-request/","name":"EFRI: \"StablR discloses scale of unbacked tokens one day after EFRI renewed its MFSA request\"","type":"community_report","archive_url":"http://web.archive.org/web/20260913043446/https://efri.io/stablr-discloses-scale-of-unbacked-tokens-one-day-after-efri-renewed-its-mfsa-request/","credibility":2,"archive_timestamp":"2026-09-13T04:34:46+00:00"},{"url":"https://efri.io/efri-urges-mfsa-to-review-stablrs-emi-license/","name":"EFRI: \"EFRI Urges MFSA to Review StablR's EMI License\"","type":"community_report","archive_url":"http://web.archive.org/web/20260812122056/https://efri.io/efri-urges-mfsa-to-review-stablrs-emi-license/","credibility":2,"archive_timestamp":"2026-08-12T12:20:56+00:00"},{"url":"https://www.vixio.com/insights/pc-former-payvision-execs-fined-aml-failures","name":"Vixio: \"Former Payvision Execs Fined For AML Failures\"","type":"news_article","archive_url":"http://web.archive.org/web/20260211223247/https://www.vixio.com/insights/pc-former-payvision-execs-fined-aml-failures","credibility":2,"archive_timestamp":"2026-02-11T22:32:47+00:00"},{"url":"https://fintelegram.com/efri-goes-after-stablrs-malta-licence-will-krakens-new-stake-survive-the-aml-storm/","name":"FinTelegram: \"EFRI Goes After StablR's Malta Licence — Will Kraken's New Stake Survive the AML Storm?\"","type":"community_report","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://fintelegram.com/payvision-scandal-dutch-authorities-cover-up-fraud-former-coo-now-runs-regulated-stablecoin-provider/","name":"FinTelegram: \"Payvision Scandal: Dutch Authorities Cover Up Fraud, Former COO Now Runs Regulated Stablecoin Provider\"","type":"community_report","archive_url":"http://web.archive.org/web/20261022185138/https://fintelegram.com/payvision-scandal-dutch-authorities-cover-up-fraud-former-coo-now-runs-regulated-stablecoin-provider/","credibility":3,"archive_timestamp":"2026-10-22T18:51:38+00:00"},{"url":"https://fintelegram.com/the-stablr-paradox-when-strategic-investments-fail-to-drive-growth-a-framework-for-analyzing-small-stablecoin-issuer-viability/","name":"FinTelegram: \"The StablR Paradox: When Strategic Investments Fail to Drive Growth\"","type":"community_report","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://tether.io/news/tether-invests-in-stablr-to-promote-stablecoin-adoption-in-europe/","name":"Tether: \"Tether Invests In StablR To Promote Stablecoin Adoption In Europe\"","type":"official","archive_url":"http://web.archive.org/web/20260905165207/https://tether.io/news/tether-invests-in-stablr-to-promote-stablecoin-adoption-in-europe/","credibility":2,"archive_timestamp":"2026-09-05T16:52:07+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-08-12T12:05:54.286716+00:00","updated_at":"2026-11-08T11:10:53.257601+00:00"},"source_quality":{"total":12,"tier1":0,"tier2":1,"tier3":0,"unrated":11},"follower_count":null,"content_updated_at":"2026-11-02T04:34:28.958Z","last_fact_checked_at":"2026-11-02T04:34:28.685Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}