EURR and USDR, stablecoins issued by StablR, have each lost their euro and dollar pegs following an exploit on StablR’s multisignature wallets.

 

The exploit, first flagged by on-chain sleuth ZachXBT, led to losses of about $10 million. According to ZachXBT, two contracts tied to StablR were exploited, with the attacker funding their wallet through Circle’s Cross Chain Transfer Protocol (CCTP) on Noble.

 

In a further update on his Telegram channel, ZachXBT said he had helped freeze six figures worth of the stolen funds, while adding that the StablR team appeared to be inactive as the attack was still ongoing three hours after he raised the alarm.

 

Blockchain security company Blockaid also detected the exploit, attributing the compromise to a private key issue in StablR multisignature wallets. According to Blockaid, the attacker gained access to one of StablR’s three multisignature wallets.

 

Since the multisignature wallet had a threshold of 1 out of 3, the attacker, after gaining admin access, replaced the other two legitimate owners. The attacker then minted 8.35 million USDR and 4.5 million EURR stablecoins and swapped them on decentralized exchanges. Blockaid further stated that the attack was not a smart contract bug, but instead a key management and governance failure.

 

A few hours after the incident was flagged, the StablR team issued a security update stating that they were actively working to contain and minimize the impact of the hack.

 

 

At the time of writing, EURR, StablR’s euro-pegged stablecoin, had lost about 53 percent of its value, dropping to about $0.54 according to CoinGecko. USDR, the stablecoin pegged to the US dollar, had risen slightly to $0.99.

 

This is not the first time a protocol has lost its stablecoin peg due to a governance exploit. In March of this year, Resolv Lab suffered a governance exploit that enabled attackers to gain admin access and mint roughly $80 million worth of Resolv’s USR, a dollar-pegged stablecoin.

 

Due to this uncontrolled minting, the USR stablecoin lost its peg to the US dollar, crashing to roughly $0.05 within minutes. USR is currently trading at $0.16 according to CoinGecko.

 

 

Onchain sleuth ZachXBT has accused stablecoin issuer Circle of improperly freezing 16 hot crypto wallets. The freeze is reportedly linked to an ongoing civil case in the United States, but ZachXBT said the company failed to conduct adequate due diligence before taking action.

 

 

“An analyst with basic tools could have identified, within minutes, that these were operational business wallets from the thousands of transactions they process,” he said.

 

According to ZachXBT, the wallets were used for business purposes. “I reviewed the onchain activity, and the exchanges, casinos, and forex businesses do not appear to be related to one another,” he added.

 

The crypto investigator also criticized the judicial process that approved the freeze, calling it the “most incompetent” he has seen in more than five years of work in the field.

 

“The NY civil case is sealed and they have provided absolutely ZERO basis to freeze all of these business addresses. [...] The expert witness is liable. The judge is liable. Circle is liable,” Zach said. “This is what happens when you outsource your freezing decisions to literally any random federal judge instead of having a process,” he added.

 

Following the callout by the on-chain investigator, Circle reportedly unfroze one of 16 wallets. According to Zach, the wallet with the address "0x61f…e543," which holds 130,966 USDC and is linked to Goated, has been unfrozen. He expects more wallets to be unlocked soon.

 

The Crypto Community Reacted

The crypto community reacted with outrage, with many criticizing centralized stablecoins. “This is your 10th reminder that centrally issued stablecoins are not actually yours. They can be frozen, unlike cash,” said Mert Mumtaz, CEO of Helius Labs.

 

“I still find it hard to believe that token issuers can 'freeze' coins on EVM shitchains and call it a 'normal' feature. The CBDC is already here, and it's called USDC,” said Francis Pouliot, CEO of crypto platform Bull Bitcoin.

 

Circle’s History With Freezes

Like many centralized stablecoin issuers, Circle has a history of freezing crypto assets. In May 2025, it froze approximately $57 million in USDC linked to the memecoin project LIBRA, as well as 2,997,180 USDC held in an Ethereum address flagged for suspicious activity.

 

Most of these freezes were legally justified and are part of Circle's efforts to curb money laundering and other illicit activities on the blockchain. 

 

However, some critics have raised concerns about centralization, noting that centralized stablecoin issuers can freeze users' crypto assets at their discretion, a clear departure from the user control promised by blockchain technology.