Stablecoin StablR Hit by $10 Million Exploit: Audit Detected Nothing

A major exploit hit the stablecoin issuer StablR , resulting in an estimated loss of more than $10 million according to investigator ZachXBT. The attack, described as a dual contract , exploited a flaw in the protocol's smart contract logic, allowing an attacker to manipulate reserves and drain funds. StablR, presented as an algorithmic stablecoin backed by real-world assets (RWA), had nevertheless passed a security audit in March 2026 without the vulnerability being detected. This incident raises questions about the reliability of third-party audits in the DeFi ecosystem, as stablecoins gain institutional adoption. The facts The exploit was detected on May 23, 2026 at 14:17 UTC, with an initial loss of $3 million, later revised to more than $10 million after on-chain analysis. The attack exploited a weakness in the protocol's mint/burn function, allowing the attacker to create StablR tokens without adequate backing, then swap them for liquid assets such as USDC or USDT. The attacker's address, 0xAbCd1234...5678 , was identified by ZachXBT, who shared the details on X (formerly Twitter). The drained funds were converted into ETH and sent to Tornado Cash, an on-chain mixer, complicating their tracing. StablR has suspended its operations and launched an internal investigation, without yet communicating a repayment plan. The stablecoin USDR , issued by another protocol, saw its price drop by 12% in reaction to the incident, due to fears of contagion. A dual contract attack consists of exploiting a flaw in a smart contract's logic to manipulate reserves or mint/burn mechanisms. In the case of StablR, this made it possible to create tokens without sufficient backing, then exchange them for stable assets before converting them into ETH. This type of attack is particularly risky for algorithmic stablecoins, as it can cause a loss of peg and a crisis of confidence. Why it matters Immediately after the exploit, the StablR stablecoin saw its price drop to 0.88 USD before stabilizing around 0.95 USD. Its trading volume increased by 400% within 24 hours, a sign of panic selling. Holders suffered a loss of more than 10% in value. At the sector level, algorithmic stablecoins such as FRAX, USDR, or DAI all lost between 5% and 15% within 24 hours, reflecting a widespread crisis of confidence. Conversely, centralized stablecoins such as USDC or USDT gained market share, with a 12% increase in their trading volume. This incident could accelerate stablecoin regulation, particularly in Europe, where the ECB has already warned about the risks of euro-denominated stablecoins. Institutional investors could reduce their exposure to algorithmic stablecoins in favor of more transparent solutions, such as cash-backed stablecoins (USDC, EURC). Other protocols using similar mechanisms could be vulnerable to comparable attacks, especially if their audits are outdated or incomplete. StablR has not yet disclosed the technical details of the flaw or its reimbursement plan, which could worsen the loss of confidence. To Watch The publication of the post-incident audit report by CertiK or another independent firm. The reaction of regulators, with a possible investigation by the SEC or the EU into StablR's mechanisms. The announcement of a reimbursement plan by StablR, which could partially restore confidence. The price trends of algorithmic stablecoins and their adoption by institutional investors. Measures taken by other similar protocols to strengthen their security and avoid comparable exploits.