Core Facts
Korean outlet Tokenpost, citing a May 24 report by The Block, reported that StableR — a stablecoin issuer backed by both Tether and Kraken — saw its euro stablecoin EURR and dollar stablecoin USDR both depeg following a multisig wallet exploit. According to the report, the attacker exploited a permission flaw in a 1-of-3 multisig wallet (where any one of three signers can authorize operations) to mint approximately $13.5 million in unbacked tokens. This figure currently comes solely from The Block’s original report as relayed by Tokenpost; StableR and Tether have not yet issued official confirmations or a final accounting of the affected amounts. The incident puts two perennial questions back on the table: “reserve trust” and “issuance permission management” in stablecoins (Tokenpost report).
Editorial Take · Practical Impact on USDT Card Users
This event does not directly affect USDT, but the transmission pathways are worth reading through if you hold any U card.
EURR and USDR are small-cap stablecoins. They are simply not on the deposit whitelists of the vast majority of mainstream virtual cards — MPCard, Bybit Card, OKX Card — which acts as a first firewall. So if you only top up and spend with USDT, this incident has zero direct impact on your balance, limits, or settlement price.
That said, three indirect transmission channels are worth watching:
The first is market sentiment. Any headline reading “stablecoin backed by Tether runs into trouble” will briefly amplify retail distrust of USDT itself — even though StableR is a Tether investee/partner, not the USDT issuer. In past sentiment events of this kind, on-chain USDT deposits and withdrawals on CEXs have experienced short-lived congestion or premium fluctuations, but the precise discount varies by event. Do not anchor to any fixed number.
The second is the issuance permission layer. A 1-of-3 multisig is a textbook example of “trading security for operational efficiency.” If you hold any stablecoin issued by a small team with an undisclosed multisig structure — including certain algorithmic stablecoins or DeFi protocol LP tokens — this is a direct red flag.
The third is regulatory spillover. Asia-Pacific regulators, especially in Japan and South Korea, are highly sensitive to “stablecoins issued by unlicensed issuers.” As we have outlined on our Japan USDT Virtual Card Compliance and Hong Kong U Card Compliance pages, multiple Asia-Pacific jurisdictions have, since 2025, drawn a clear distinction at the card-network and issuing-bank level between “stablecoins on the licensed list” and those that are not. EURR/USDR are clearly not on any Asia-Pacific licensed list, meaning that even without a depeg they would never appear on a compliant U card’s supported asset list.
Historical Comparison: How This Depeg Differs From Previous Ones
Placing this event in the spectrum of depeg incidents from recent years:
- 2022 UST collapse: Algorithmic stablecoin mechanism failure, tens of billions of dollars in scale, a market-level shock.
- March 2023 USDC brief depeg: Circle had $3.3 billion in exposure to SVB, a confidence-driven depeg from reserve transparency concerns — recovered within 48 hours, a “macroeconomic risk transmission” event.
- 2023–2024 small-cap stablecoin incidents: Mostly oracle or cross-chain bridge attacks, smaller in scale, no contagion to mainstream stablecoins.
- This StableR event: The issuance permission layer was breached, enabling tokens to be minted from nothing — essentially the equivalent of counterfeiting. The scale is relatively small (reportedly in the tens of millions of dollars), but the nature of the attack is more severe than a reserve shortfall.
The most relevant comparison for USDT card users is not UST or USDC, but those 2023 small-cap stablecoin incidents — mainstream USDT and USDC saw virtually no price-level contagion, but the compliance perimeter tightened: several Asia-Pacific card issuers subsequently trimmed their “supported stablecoin whitelists” down to 2–3 mainstream assets.
Regulatory and Compliance Boundaries
A few points that can be stated clearly at this time:
- Explicitly permitted: USDT and USDC, spent via licensed card issuers in most Asia-Pacific jurisdictions, remain “a compliant grey zone but practically usable.”
- Explicitly prohibited: In South Korea and Japan, unlicensed stablecoins may not circulate on domestic exchanges. Small-cap coins like EURR/USDR were already largely unable to enter these markets.
- The genuine grey zone: Asia-Pacific-routed cards like MPCard and Bybit Card, if they ever support more stablecoins in the future, will inevitably have to answer the question: “How do you vet the issuance permission structure of newly added stablecoins?”
If you are based in the EU, we recommend also consulting our EU MiCAR Compliance Key Points page — MiCAR sets explicit licensing requirements for euro stablecoin issuers, and an unlicensed euro stablecoin like EURR would already face high barriers entering any compliant card channel in the EU.
Key Milestones to Watch Going Forward
- Official announcements from StableR and a statement from Tether: As of publication, neither party has issued a formal statement. Whether Tether will distance itself from the project, and whether this affects Tether’s multisig policies for other investee projects, is the most important downstream signal.
- Follow-up reporting by The Block: The precise scope of the $13.5 million figure (whether it includes already frozen or recovered amounts) still needs independent verification.
- Whether Kraken delist EURR/USDR: As one of the backers, Kraken’s response will directly affect the liquidation pathways for both tokens.
- Whether Asia-Pacific regulators issue statements: Particularly any updates to the licensed stablecoin lists from Hong Kong’s SFC and Singapore’s MAS — we will track these on our Hong Kong Compliance and Singapore Compliance pages.
Editorial Recommendations
- Users holding mainstream U cards such as MPCard, Bybit Card, or OKX Card and topping up exclusively with USDT: This event has no direct impact on you. No action is needed.
- Users considering applying for a new virtual card: You can proceed as normal by following the 2026 Top 5 U Cards list — there is no reason to delay because of this incident.
- Users holding EURR, USDR, or any stablecoin issued by a small team with an undisclosed multisig structure: We recommend exiting to a mainstream stablecoin immediately rather than waiting for an official announcement, since announcements typically lag behind price movements.
- New users wanting to understand stablecoin basics: Start with What Is a U Card to understand the fundamental boundary: “the stablecoins a card supports ≠ all stablecoins on the market.”
There is no such thing as “absolute safety” in the stablecoin world, but there is “reasonable risk stratification.” Keeping 99% of your funds in a combination of mainstream licensed issuers and mainstream licensed card providers, while accepting personal responsibility for any risk taken with the remaining 1% — that principle serves you better than repositioning every time a headline breaks.