StablR
An attacker minted approximately $11M of unauthorized stablecoins after compromising a single operations key that controlled the mint authority on both EURR and USDR. The mint-authority contracts are the original ConsenSys MultiSigWallet (not Gnosis Safe), and both were configured with required=1, meaning one signer could submit and execute any transaction immediately. The attacker then added three decoy owners and removed both legitimate owners during the attack, making the public picture look like a multi-party compromise when it was a single key. About 7,010,000 EURR and 3,310,000 USDR were minted to nine attacker-controlled wallets over three hours. Both stablecoins depegged; USDR to about $0.78 and EURR to about $0.88.
StablR has not been scored by our risk model. The relevant control surface for this attack is custody architecture, specifically the threshold on the mint-authority multisig, the separation of duties between EURR and USDR signer sets, and whether signer keys live in HSM, MPC, or raw EOA wallets. A configuration like required=1 is not visible from contract bytecode and would not be caught by a code audit, so a contract-only audit could not have flagged this failure mode.
An attacker compromised the operations key for the true legitimate signer that controlled both StablR multisigs. Both multisigs are the old ConsenSys MultiSigWallet (not Gnosis Safe) and both had required=1, so a single key was sufficient. The attacker added three decoy owners on the EURR multisig and the USDR multisig, removed both legitimate owners, and minted 7M EURR and 3.3M USDR into nine attacker wallets. Proceeds are being dumped via DEX swaps and consolidated into an ETH aggregation wallet holding about 1,173 ETH.
Full forensic detail
Step-by-step reconstruction, root cause, counterfactuals, remediation, and disclosure timeline.
Exploit anatomy
submitTransaction(address,uint256,bytes) -> addOwnersubmitTransaction(address,uint256,bytes) -> addOwner / removeOwnersubmitTransaction wrapping HadronToken.mint(address,uint256)tx:0x775d63fb...a1caa9transfer / DEX swapRoot cause
The mint authority on both EURR and USDR was vested in ConsenSys MultiSigWallet contracts (Stefan George, Solidity 0.4.16, not Gnosis Safe) configured with required=1. This is single-signer authority in multisig clothing: any owner could submit any transaction and have it auto-execute on the same call. The attacker compromised one operations signer (0xc73fd562...), then used that key to (1) add three attacker-controlled addresses as new owners on both multisigs, (2) remove both legitimate owners, and (3) mint 7.01M EURR and 3.31M USDR through the newly-controlled mint authority. The compromise vector for the original key is undetermined, but the compromised wallet had collected airdrops from multiple low-quality tokens (Claude, QAI, AIG, OpenClaw, FEAST, BlackGold, WAR) in the months before the attack, an operational anti-pattern that turns a mint-authority key into a phishing target. The HadronToken implementation itself (Tether Hadron Limited) is a standard upgradeable ERC20 with onlyOwner mint(); the exploit was access-control bypass via key compromise plus owner-set manipulation, not a smart contract bug. The attacker also added three decoy 'co-signers' to make the attack look multi-party, a novel obfuscation pattern that misled major news outlets into the wrong framing. The compounding factors: shared owner sets across both stablecoins (one key compromise drained both), no realtime Mint() event monitoring (3-hour drain went unhalted), and a marketing claim of 'MPC and Multisig technology' inconsistent with the deployed required=1 single-sig configuration.
Prevention analysis
If the Safe required at least 2 of 3 signatures, a single signer compromise would be insufficient. The attacker would need at least one additional key to execute. This is a one-call configuration change on the Safe contract (changeThreshold).
A single signer compromise should drain at most one stablecoin, not both. The 2-for-1 outcome here resulted from operational convenience (one signer set for both Safes) creating a single point of failure across the entire StablR product line.
Eliminates the most likely exfiltration vectors (CI/CD secret leak, laptop key extraction). Industry-standard for regulated EMI issuers handling mint authority on production stablecoins.
The HadronToken contract emits a Mint event on every privileged mint. Realtime monitoring (Forta, Tenderly, Hypernative) on unauthorized Mint events would have triggered within seconds of the first mint, allowing a separate pauser Safe (different signer set) to pause the token. Would have cut the 3-hour drain to under 10 minutes.
Similar incidents
AWS KMS minter key compromise (March 2026). $80M unauthorized USR minted, $25M extracted, immediate depeg. Identical mechanism: privileged mint, no realtime monitoring, no out-of-band signing approval.
Multisig signer compromised via blind-signing social engineering on a 2/5 Safe (April 2026, $285M). Same root cause: weak operational security on privileged authority.
Operational hot-wallet private-key compromise on Polygon (May 2026, $700K). Smaller scope (no mint authority) but identical anti-pattern of single-key custody for protocol-adjacent value.
Remediation
Timeline
Get your protocol scored across 12 dimensions, or request ongoing coverage.