#HYPEMarketCapSurpassesDOGE 🚨 StablR Stablecoin Protocol Suffers Major Exploit; EURR and USDR Depeg by 20%

MAY 24, 2026 — The stablecoin protocol StablR was hit by a devastating governance exploit over the weekend, resulting in the malicious takeover of its token contracts and a massive unauthorized minting event. The attacker managed to replace the Owner permissions of the protocol, subsequently minting and dumping millions of dollars worth of its native Euro (EURR) and USD (USDR) stablecoins, driving both assets into a sharp 20% depeg.
The Anatomy of the Attack
According to on-chain tracking data compiled by security firm Bitrace, the incident specifically targeted the core security apparatus of the StablR USD project MultiSig wallet.
Once the attacker successfully hijacked the management permissions for the USDR and EURR smart contracts, they executed a two-pronged extraction:
Token Minting: The exploiters illegally minted 8.35 million USDR and 4.5 million EURR.
The Liquidation: These newly minted tokens were rapidly dumped across both centralized and decentralized exchanges (DEXs) for Ethereum.
The Bounty: The attacker has already successfully washed and secured over 1,600 ETH (valued at approximately $2.8 million).
A Breakdown of Governance Failures
Security analysts emphasize that this incident was not caused by a typical, complex smart contract code vulnerability. Instead, it stems entirely from severe, foundational protocol governance flaws and operational oversight by the stablecoin issuer:
🛑 Critical Governance Flaws Exploited:
The Single-Signature Threshold: The multi-signature wallet threshold had long been improperly configured to 1-of-X. This meant a single signature could execute any top-level command. Consequently, compromising just one owner key granted the attacker total operational control over the entire system.
Negligent Private Key Custody: Poor operational security (OpSec) led directly to the exposure and leakage of the key owner's private keys.
Absence of a Time-Lock: The protocol entirely lacked a time-lock mechanism. Because there was no mandatory delay or secondary confirmation phase required to finalize administrative upgrades, the attacker was able to instantly switch ownership permissions and execute the mint with zero buffer time for the team to intervene.