European stablecoin issuer StablR has suspended minting and redemption services for its USDR and EURR tokens after a cyberattack left the assets under-collateralized. According to reports from ZachXBT, the attack compromised two contracts tied to StablR's stablecoins, with the Malta-based firm detecting 'irregularities' in its systems after internal alerts triggered an investigation. The company froze token operations and asked exchanges to halt trading, deposits and withdrawals for both stablecoins while investigating the breach.
The attack allowed attackers to compromise a single key, add themselves as administrator and remove legitimate signers before minting approximately 8.35 million USDR and 4.5 million EURR tokens, totaling about $13.5 million in unbacked tokens at peg. As reported by GoPlus Security, the attack exploited a weakness in StablR's 1-of-3 multisignature wallet setup, where any one of three authorized owners could approve transactions alone. The thin liquidity on decentralized exchanges meant the attackers netted roughly $2.8 million after offloading the freshly minted supply. According to ZachXBT, the attacker address was funded via CCTP on Noble, with both EURR and USDR reportedly losing more than 20% of their peg during the incident.
Payments app Oobit blocked and froze part of the funds linked to the exploit, acting swiftly within two hours to prevent further damage. According to Oobit's statement, the company detected the irregularity and froze six figures worth of euros (EUR) while shutting down the off-ramp. Oobit emphasized that no user funds were affected and no breach occurred on its platform, stating "No user funds touched. No breach. No hesitation." The company is currently cooperating with StablR and respective investigating bodies to help recover the lost money and thanked ZachXBT for bringing attention to the exploit.
According to StablR's statement, the circulating supply of USDR and EURR is 'currently not fully backed at the 1:1 ratio' as required under the European Union's Markets in Crypto-Assets (MiCA) regulation. The company plans to notify Malta's financial regulator, the Malta Financial Services Authority, under the EU's Digital Operational Resilience Act and MiCA reporting rules. External cybersecurity firms and law enforcement agencies are also involved in the investigation.
Following the breach, StablR's tokens briefly lost as much as 50% of their peg before starting to recover. According to CoinGecko data, USDR currently has a $20 million market capitalization, while EURR has a $10 million market cap. CEO Gijs op de Weegh stated the company is acting 'with full transparency' as the investigation continues. The quick reaction of companies like Oobit denied the hacker the opportunity to launder most of the hacked funds via centralized off-ramp services, demonstrating how monitoring systems can minimize impact when exit points are centralized.
