In brief
- StablR’s two MiCA e-money tokens, EURR and USDR, have had minting and redemption suspended since 24 May 2026, after an attacker minted tokens outside its issuance process. StablR reported on 25 August that about 6.41 million EURR and 14.33 million USDR of unauthorised tokens remained in circulation and were not backed by reserves (StablR notice).
- The observed net Ethereum supply increases agree with those approximate figures at the reported precision: 42 mint transactions between 23:47 UTC on 23 May and 04:03 UTC on 24 May, one burn per token, and no mint or burn since. StablR’s reported unauthorised amounts equal about 37% of EURR and 68% of USDR supply on Ethereum; we have not verified current reserves (checked 29 September 2026).
- ESMA’s interim MiCA register still lists StablR Ltd as an authorised EMT issuer with no end date. StablR has not said how lawful holders will be told apart from holders of the unauthorised tokens when redemption resumes.
Reader question: what happens to a MiCA-authorised e-money token when its issuer is hacked: what is still backed, who can redeem, and what does the register say?
StablR Ltd is a Maltese company that issues two fiat-referenced tokens under MiCA, the StablR Euro (EURR) and the StablR USD (USDR). It counts Tether and Kraken among its investors and pitched the tokens at exchanges and institutional settlement. In May 2026 an outside party gained access to part of its infrastructure and minted tokens without paying for them. This profile sets StablR’s own notices against the token contracts and the EU register, and reconciles StablR’s reported unauthorised amounts with the tokens’ Ethereum supply.
Current status: what StablR reports and what we observed
- Minting and redemption: paused (company-reported) since 24 May 2026, and still paused in the latest notice of 25 August 2026, which says StablR is working towards “an orderly resumption under the supervision of the MFSA”. No date is given.
- Trading: company asked venues to suspend (company-reported). On 25 May StablR asked all listed exchanges to suspend trading, deposits and withdrawals in both tokens. We have not checked each venue.
- Recovery Plan: active (company-reported) since 29 May 2026. StablR’s board activated it and notified the MFSA, citing the EBA Guidelines on recovery plans under MiCAR.
- Supply: no mint or burn since 24 May (our on-chain observation). The contracts’ Transfer logs show no mint or burn event between block 25168597 (25 May) and block 26079226 (28 September 2026). Ethereum totalSupply is 17,143,032.56 EURR and 21,076,437.51 USDR at both blocks.
Entity and authority
| Entity | Jurisdiction | Status | What it permits | Source |
|---|---|---|---|---|
| StablR Ltd (C 104007) | Malta | Company-reported: MFSA Financial Institution, Third Schedule to the Financial Institutions Act | Issue EMTs under MiCA | stablr.com footer |
| StablR Ltd, LEI 984500AA0OCA9CE0D796 | EU (ESMA interim register) | Listed: EMT issuer, electronic money institution, authorised 21/06/2024, no end date | EURR and USDR white papers notified 14/11/2025 | ESMA EMTWP.csv, read 28 September 2026 |
| STABLR LTD. | GLEIF | LEI active, issued, renewal due 27 March 2027 | Identity only | GLEIF record |
The ESMA register is an interim list that national authorities update in batches. The fact that its row has not changed does not show what the MFSA has or has not done since May. We have not read the MFSA’s own register or news pages: mfsa.mt refuses automated requests (an access limitation, not a completed check), we have not yet tried it in a normal browser, and a web search turned up no MFSA statement naming StablR. Tether made a strategic equity investment in December 2024 and Kraken invested in July 2025. StablR does not publish the size of either stake or name a parent or controlling shareholder: not publicly disclosed (about page and Kraken announcement checked).
Product scope, availability and eligibility
Before the incident, StablR sold EURR and USDR directly to onboarded business customers, who minted and redeemed against euros or dollars, and the tokens traded on exchanges. Today no one can buy the tokens from StablR or redeem them with it. The table separates what StablR’s terms of use said about direct access before the suspension from what applies now.
| Question | Before 24 May 2026 (StablR terms of use) | Now |
|---|---|---|
| Who could mint and redeem directly | Legal persons only (“a judicial person”) who pass StablR’s client acceptance, onboarding and KYC procedures and accept the T&Cs | No one: suspended (company-reported) |
| Excluded customers | “Prohibited Subscribers”: entities incorporated, registered or controlled in jurisdictions where the tokens are prohibited, explicitly including the United States (and US tax residents), FATF high-risk countries, and countries “outside the risk appetite of the Company” | Same terms; service paused |
| Minimums and fees for direct mint and redemption | Not publicly disclosed: the terms define a “Subscription Amount” the company accepts “at its sole discretion” and defer redemption to “the Documents”; no minimum or fee schedule on the terms, EURR, USDR or white-paper pages | Not applicable while paused |
| Legal holder of reserves | StablR Ltd: euro payments go by wire “to the Custodian’s bank account” and are held in “Segregated Client Accounts” under Malta’s Financial Institutions Act (Safeguarding of Funds) Regulations, SL 376.04 | Company-reported: reserves “not affected by the incident” (25 August notice); not yet verified |
| Banks and custodians | Not publicly disclosed: the terms and proof-of-reserve page refer only to “correspondent banking partners” and a “diversified custodian banking network” | Same |
| Deposit insurance | Not publicly disclosed: no StablR page we checked says deposit insurance applies. | Same |
MiCA authorisation does not by itself tell a buyer whether it is eligible; the terms above are StablR’s own conditions.
Reconciling StablR’s reported unauthorised issuance with Ethereum supply
| Ethereum totalSupply | EURR | USDR | Source |
|---|---|---|---|
| 22 May 2026, block 25147072 | 10,731,659.05 | 6,744,149.20 | Our read of the token contracts |
| 25 May 2026, block 25168597 | 17,143,032.56 | 21,076,437.51 | Our read of the token contracts |
| Change | +6,411,373.51 | +14,332,288.31 | Derived |
| StablR’s unauthorised-mint figure | about 6.41 million | about 14.33 million | Notice, 25 August 2026 |
| 28 September 2026, block 26079226 | 17,143,032.56 | 21,076,437.51 | Our read of the token contracts |
| Company-reported unauthorised issuance as a share of observed Ethereum supply | 37.4% | 68.0% | Derived: StablR figure (25 August) over our 28 September supply read |
Method: ERC-20 totalSupply() read at fixed blocks through a public Ethereum node (EURR 0x5075…e408, USDR 0x7b43…c8f8), and every mint and burn event (Transfer from or to the zero address) from block 25147072 to 26079226, pulled from the Blockscout logs API on 29 September 2026. In that range the only mints are 15 EURR transactions totalling 9,110,000 and 27 USDR transactions totalling 16,760,000, all between 23:47 UTC on 23 May and 04:03 UTC on 24 May. There is one burn per token around 03:30 UTC on 24 May: 2,698,626.49 EURR and 2,427,711.69 USDR. Net of the burns, that is +6,411,373.51 EURR and +14,332,288.31 USDR, equal to the change in supply. The logs do not show which of these mints StablR counts as unauthorised. The logs do not say who made the burns, and StablR’s notices do not mention them. StablR does not say which chain its figures cover. They agree with the Ethereum change, and the only other chain its site links, Solana, showed zero EURR supply on 28 September, but we have not checked Solana’s history or any other chain, so the Ethereum scope is our assumption. Neither Ethereum contract exposes a paused() function, so this reading cannot tell whether transfers are frozen on-chain.
What this means for a holder: StablR says properly issued tokens remain fully backed. We have not independently verified current reserves. The lawful and the unauthorised tokens are the same ERC-20 on the same contract, and StablR’s notices do not explain how redemption rights will be assessed for holders, including those who bought tokens on secondary markets.
Dependencies
- Reserves: StablR says the assets are held in segregated accounts and money market funds, separate from its own funds, and were “not affected by the incident”. The banks and custodians are not named on its proof-of-reserve page.
- Attestation: StablR’s proof-of-reserve page lists Grant Thornton quarterly reviews (ISRE 2400) for Q1-Q4 2025 only. None covers the period of the incident.
- Technology: StablR’s about page says it is “powered by Tether” and names the Hadron by Tether platform. StablR has not said which part of its infrastructure the attacker reached.
- Chains: Ethereum (both tokens) and Solana (EURR, zero supply). StablR also announced EURR and USDR for Concordium in September 2025; we have not checked supply there.
Alternatives
| StablR (EURR, USDR) | Circle (EURC, USDC in the EEA) | Paxos (USDG in the EU) | |
|---|---|---|---|
| EU issuer and authority | StablR Ltd, MFSA (Malta) | Circle Internet Financial Europe SAS, ACPR EMI, CIB 17788 (REGAFI) | Paxos Issuance Europe Oy, FIN-FSA EMI (Paxos licences page) |
| ESMA register authorisation date | 21/06/2024 | 01/07/2024 | 23/11/2022 |
| Redemption today | Suspended since 24 May 2026 | Issuer-published: Circle’s MiCA Redemption Policy offers EEA retail holders a form-based route and other holders a Circle Mint account (policy) | Issuer-published: only registered Customers may redeem from Paxos (stablecoin terms) |
Circle publishes redemption routes for EURC and USDC; Paxos publishes a customer-only redemption policy for its US dollar stablecoins, and USDG is a dollar token, not a euro alternative. Paxos’s US Dollar-Backed Stablecoin Terms name Paxos Digital Singapore Pte. Ltd. and Paxos Issuance Europe Oy as joint managers of USDG; whether EU holders have additional MiCA redemption terms from the Finnish entity is not yet verified. These are issuer-published policies: we have not tested either route. For existing EURR and USDR holders the comparison is moot until StablR publishes how redemption will resume.
Limitations and unknowns
- How lawful holders will be distinguished from holders of the unauthorised tokens at resumption: not publicly disclosed (all StablR notices from 25 May to 25 August 2026 checked).
- Whether and when redemption resumes, or the tokens move to new infrastructure: not publicly disclosed. The July notice says StablR cannot comment on “specific measures, timelines, or next steps”.
- Current reserve balance against the 10.73 million EURR and 6.74 million USDR in supply before the incident: not yet verified. The live widget on the proof-of-reserve page does not show its figures to our reader, and the latest Grant Thornton review covers Q4 2025.
- Any MFSA statement or measure concerning StablR: not yet verified. mfsa.mt refused our automated requests (Cloudflare block, 29 September 2026), a web search found no MFSA statement, and we have not yet checked the register in a normal browser.
- Attack vector, and whether the Hadron by Tether platform was involved: not publicly disclosed (StablR notices 25 May to 25 August 2026 checked; none names the vector).
- Whether transfers are frozen on-chain: not yet verified. Neither Ethereum contract has a
paused()function (our call reverts), and we have not tested transfers or blacklist functions. - Who made the two burns on 24 May 2026, and why: not publicly disclosed. The burning addresses (0x7297…6fa3, 0x2e0e…8768) are unlabelled on Blockscout, and no StablR notice mentions the burns.
- Which banks and custodians hold the reserves: not publicly disclosed (terms of use and proof-of-reserve page checked).
Key facts (as of 28 September 2026)
- Legal entity: StablR Ltd, Malta, company C 104007, LEI 984500AA0OCA9CE0D796
- Tokens: EURR, USDR (MiCA EMTs); white papers last modified 4 December 2025
- Minting and redemption: suspended since 24 May 2026; Recovery Plan active since 29 May 2026
- Ethereum supply: 17.14 million EURR, 21.08 million USDR (block 26079226)
- Unauthorised tokens in circulation, not backed by reserves (company-reported, 25 August 2026): about 6.41 million EURR and 14.33 million USDR
- Investors named by StablR: Tether (December 2024), Kraken (July 2025)
Sources
- ESMA, interim MiCA register, EMT issuers (EMTWP.csv), read 28 September 2026
- GLEIF, LEI record 984500AA0OCA9CE0D796
- StablR notices: incident disclosure (25 May 2026), Recovery Plan activation (29 May 2026), update of 28 July 2026, update of 25 August 2026, proof of reserve
- Ethereum token contracts EURR and USDR; our totalSupply reads at blocks 25147072, 25168597 and 26079226; mint and burn events via the Blockscout logs API
- StablR, Kraken investment announcement (21 July 2025) and about page
- Circle, MiCA Redemption Policy; Paxos, stablecoin terms and licences
Last updated: 29 September 2026. Next recheck triggered by: any StablR notice on resuming minting or redemption or on migration, an MFSA statement, a change in the ESMA register row, or any change in the tokens’ on-chain supply.
