StablR Governance Crisis: How Attackers Hijacked EURR and USDR

On May 24, 2026, stablecoin protocol StablR was exploited after attackers seized ownership of its token contracts. Large quantities of EURR and USDR were illegally minted and dumped on the market, causing both stablecoins to rapidly lose value and depeg by approximately 20%.

This report analyzes the exploit and traces the flow of stolen funds.

How the Attack Worked

The exploit targeted two of StablR’s stablecoins using the same method. Taking the Gnosis MultiSigWallet contract 0x8278d2881dbf8f6fc01c98d196c4b16f1aade5bc — deployed by StablR USD: Deployer to manage USDR token operations — as a case study:

Below is the full timeline of owner permission changes to that contract.

Issuer Deployment Phase

 Attacker Takeover Phase

 The evidence points clearly to a targeted attack on StablR USD’s MultiSig wallet:

1. The original owner 0xc73fd562... was either compromised or acted maliciously.

2. Using that account, the attacker in under 15 minutes replaced all owners with attacker-controlled addresses — executing three transactions in total.

3. Once in control, the address flagged by Etherscan as “StablR Exploiter 3” used the hijacked multisig to repeatedly call submitTransaction — executing mint, burn, and drain operations to continuously extract value from the contract.

4. StablR Euro was targeted in the same way; those details are not repeated here.

 Attack Outcomes

Once the attackers gained control of the USDR and EURR contract admin keys, they minted large volumes of tokens and liquidated them through both centralized and decentralized exchanges, causing both stablecoins to suffer a severe depeg.

As of 16:00 CST (UTC+8) on May 24, 2026, StablR had yet to issue any public statement on the incident.

According to Bitrace’s on-chain tracking, the attacker has stolen more than 1,600 ETH to date. The funds are spread across multiple Ethereum addresses, including but not limited to—

0x09be1a36c2d7f9909eb3d6f9184c6e46a12b0aca

0xa59d6ac9cbd44952fd544ae1fd6ff7e8f226aa4e

0x3a851263c36a6427d6c7d86a564ef427b570859b

0x7ec05d1d6b0cbf4e74bd5907d01aeeb4343c6376

 Key Takeaways

This was not a typical smart contract vulnerability — it was a governance failure on the part of the stablecoin issuer:

 1. The multisig threshold had long been set to 1, meaning a single signature was sufficient to authorize any transaction. Any compromised owner effectively handed over total control.

2. Poor private key management led to the exposure of a critical owner key.

3. The absence of a timelock meant any owner change took effect immediately, with no delay or secondary confirmation required.

Contact us:

Website: www.bitrace.io

Email: bd@bitrace.io

Twitter: @Bitrace_team

LinkedIn：@bitrace tech