StablR loses parity after attack generates $13,5 million in fake news.

• Brazilian stablecoins EURR and USDR suffer sharp devaluation after attack.
• Multisig exploration generates US$13,5 million without collateral.
• Governance failure exposes risks in European MiCA stablecoins.

The EURR and USDR stablecoins, issued by the European company StablR, lost their parity over the weekend after an attack compromised the digital assets' issuance contracts. The incident allowed the creation of approximately US$13,5 million in unbacked tokens, which were quickly dumped on decentralized exchanges.

The initial was issued by on-chain investigator ZachXBT, who identified suspicious activity involving contracts linked to StablR. According to him, the attacker used Circle's Cross-Chain Transfer Protocol (CCTP) at Noble to fund the wallet used in the attack.

Hours later, ZachXBT reported that he helped freeze some of the stolen assets and stated that the company's team appeared to be "asleep" while the exploit remained active for more than three hours.

The blockchain security company Blockaid explained that the breach occurred after a private key belonging to one of the signers of the multisig responsible for minting stablecoins was compromised. The system used a configuration considered fragile, with only one valid signature out of three possible signatures.

Approximately $2.8 million extracted so far.

Both tokens are depegged: 0x50753cfaf86c094925bf976f218d043f8791e408 (StablR Euro) and 0x7b43e3875440b44613dc3bc08e7763e6da63c8f8 (StablR USD) on…

With administrative access, the attacker added his own wallet as the administrator of the contracts, removed the previous controllers, and minted approximately 8,35 million USDR and 4,5 million EURR.

A large portion of the tokens was exchanged for ETH on decentralized platforms. Even with losses caused by low liquidity, the attacker's initial gains already exceeded US$2,8 million in the first few hours of the incident.

The attack also affected legitimate users of the platform. On-chain data showed that the attacker used administrative permissions to block and destroy tokens held by third parties. In one case, approximately 2,7 million EURR were burned from a wallet that performed recurring withdrawals from StablR.

On Sunday morning, the EURR was trading near $0,85, while the USDR fell to around $0,64, increasing pressure on the credibility of the European broadcaster.

StablR acknowledged the vulnerability just hours after the suspicious activities were halted. In a statement published on X, the company said it had identified the problem and was working to contain the impact of the attack.

This episode represents a significant blow to the company, which had been positioning itself as a benchmark in stablecoins compliant with the European Union's MiCA rules. The company holds an Electronic Money Institution license issued in Malta and uses the Hadron infrastructure, developed by Tether.

In recent months, StablR had received strategic investments from Tether and Kraken, and also announced that EUR/USDR had already surpassed €3 billion in trading volume in the first half of 2025.

This case reinforces a pattern observed in 2026, marked by attacks linked to flaws in privileged access, governance, and key management, rather than vulnerabilities in smart contracts.