$13.5M Exploit Stopped Cold

A six-figure bag of stolen stablecoins just ran headfirst into a compliance team that was faster than the exploit itself. The Oobit mobile wallet detected, froze, and shut down an illicit exit route in under two hours — catching funds from the $13.5 million StablR smart contract breach mid-flight before a single satoshi touched innocent users.

🔹 The StablR attack unfolded on May 24 when an attacker compromised a single private key from a weakly configured 1-of-3 multisig wallet, gaining full minting control over the EURR and USDR stablecoin contracts. In roughly three hours, 8.35 million USDR and 4.5 million EURR were minted out of thin air and dumped on decentralized exchanges, causing USDR to crash from $1.00 to as low as $0.40 and EURR to fall roughly 15-20% below its euro peg.

🔹 The stolen funds attempted to exit the ecosystem through Oobit, the mobile wallet backed by a major stablecoin issuer. Oobit's compliance team flagged the abnormal activity immediately, froze a six-figure amount of EURR tokens, and closed the withdrawal channel entirely — all within two hours of detection. No user funds were affected, and Oobit's own systems were never breached.

🔹 The StablR breach followed the typical multisig governance failure pattern that has plagued multiple protocols in 2026. The threshold of one signer out of three reduced the entire security architecture to the strength of a single private key — and that key was compromised. Malta-based StablR, a MiCA-compliant Electronic Money Institution with claimed 1:1 fiat backing, has since suspended all issuance and redemption services for both USDR and EURR tokens.

🔹 On-chain detective ZachXBT first flagged the live exploit on May 24, and blockchain security firm Blockaid confirmed the ongoing attack shortly after. The attacker extracted approximately $2.8 million in ETH from the dump despite minting $13.5 million in face value, with low liquidity on decentralized exchanges limiting how much could be converted before prices collapsed. Oobit is now working alongside StablR and investigators to handle the subsequent recovery process.

Two hours from detection to freeze, six figures in stolen stablecoins locked down, and not a single user balance touched. The security story of 2026 is being written not by the exploits themselves but by the teams that stop them before they spread. How are you reading this — a one-off compliance win, or a blueprint for how regulated off-ramps should defend the entire ecosystem?