#StablRStablecoinDepegsAfterExploit

This is a classic and painful example of "decentralized in name only" governance coming back to bite a project. When a protocol uses a 1-of-3 multisig for something as critical as minting rights, it completely defeats the purpose of having a multisig wallet in the first place.

Here is a breakdown of what went wrong, how the attacker extracted the funds, and why the "profit" was so much lower than the face value of the tokens.

How the Attack Unfolded

The exploit was fundamentally a key management failure rather than a code vulnerability. Because the contract only required one signature out of three to execute transactions, compromising a single private key gave the attacker full keys to the kingdom.

The Attack Progression

Step 1: Key Compromise & Takeover: The attacker gained access to one of the three private keys. Using this single signature, they executed an admin command to add their own address as an owner and completely removed the two remaining, legitimate signers.

Step 2: Unbacked Minting: With total control over the minting contract, they instantly minted 8.35 million USDR and 4.5 million EURR without providing any collateral.

Step 3: The DEX Dump: The attacker rushed to decentralized exchanges (DEXs) to swap the unbacked tokens for Ethereum (ETH).

Slippage and Thin Liquidity: The $7.6M Haircut

The attacker minted a combined face value of roughly $10.4 million at peg. However, they only walked away with about 1,115 ETH (approx. $2.8 million).

Why the massive discrepancy? Thin liquidity.

Stablecoin pools on DEXs rely on deep liquidity to maintain automated market maker (AMM) pricing. Because the StablR pools were relatively shallow, the attacker's massive, sudden sell orders completely overwhelmed the available liquidity. This triggered extreme price slippage, effectively crashing the value of the very tokens they were trying to cash out during the swap itself.
The Regulatory Nuance (MiCA)

What makes this particularly notable is StablR's positioning as a European regulated, MiCA-compliant issuer. The Markets in Crypto-Assets (MiCA) regulation enforces strict rules on reserves, capital requirements, and auditing.

However, as security firm Blockaid pointed out, standard regulatory compliance audits generally focus on financial reserves and legal structures rather than real-time technical operational security (OpSec). Legal compliance does not automatically equal structural cryptographic security; a 1-of-3 multisig structure is a glaring single point of failure regardless of how compliant the underlying company is on paper.
‍$ETH