StablR’s euro and US dollar stablecoins have depegged as an ongoing exploit targets the project’s minting multisignature account. Blockchain security firm Blockaid reports that its monitoring detected roughly $2.8 million extracted so far, with the attack traced to a compromised private key in a 1-of-3 minting threshold. The attacker added themselves, replaced the other owners, and minted 8.35 million USDR and 4.5 million EURR, triggering the depegging. The newly minted tokens were swapped on decentralized exchanges for about 1,115 ETH—roughly $2.8 million—due to thin liquidity. Blockaid characterized the incident as a governance and key-management failure rather than a flaw in a smart contract.

The disruption comes amid a troubling month for crypto and DeFi security, with DeFiLlama tallying more than a dozen major exploits so far in May. Notable incidents have included attacks on THORChain, the Verus Bridge, Echo Protocol, and Polymarket, underscoring the breadth of attack vectors facing the sector this year.

Key takeaways

• Attack traced to a compromised private key in StablR’s minting multisignature account, with a weak 1-of-3 threshold enabling the breach.
• EURR depegged to about $0.88 and USDR fell to about $0.70, reflecting the immediate impact of the minting attack on liquidity and confidence.
• Approximately $2.8 million has been extracted so far, with 8.35 million USDR and 4.5 million EURR minted and swapped for ETH due to liquidity constraints.
• Blockaid stresses that the incident is fundamentally a governance and key-management failure, not an obvious smart-contract bug.
• The broader DeFi landscape in May includes numerous high-profile exploits tied to private-key and governance weaknesses, reinforcing a pattern that investors and builders should monitor closely.

How the breach unfolded and what it means for StablR

StablR operates as a regulated, collateralized stablecoin issuer offering euro- and dollar-pegged tokens. The project emphasizes reserves held in segregated accounts at established institutions, along with proof-of-reserves and cross-chain availability on Ethereum and Solana. In December 2024, StablR also drew attention when Tether invested in the project to promote stablecoin adoption in Europe. The current incident, however, highlights a stark contrast between a stated governance framework and the practical realities of key-management in multisignature setups.

According to Blockaid, the perpetrator exploited a weak key-management arrangement within the minting multsig, then assumed control of the three-key setup by replacing the other owners. The attacker minted 8.35 million USDR and 4.5 million EURR, effectively depegging the two tokens from their $1 parity bands. The minted tokens were subsequently liquidated on decentralized exchanges for approximately 1,115 ETH, translating to around $2.8 million in proceeds given current liquidity conditions. Blockaid summarized the situation by stating that this is not a smart contract bug; it is a failure of key management and governance structures that should have prevented such a takeover.

StablR’s euro stablecoin, EURR, has a market capitalization near $14 million, while its US dollar token, USDR, sits around $11 million. In the present episode, CoinGecko-tracking data shows EURR slipping from parity toward the mid-$0.80s range, and USDR hovering around the $0.70 level as the incident unfolds. The depegging has raised questions about liquidity depth, reserve sufficiency, and the speed with which stablecoins can respond to coordinated governance- or key-management failures.

There is no sense that the underlying collateral model or reserve strategy has collapsed; rather, the attack underscores the practical risk of relying on multisignature governance without robust key-management controls, hardware security modules, and regular key-rotation and access reviews. StablR notes that reserves are held in segregated accounts at top-tier institutions and that it aims to maintain transparency via proof-of-reserves and cross-chain availability. The incident has also prompted scrutiny of the project’s governance processes and incident-response posture as it works to restore confidence among users and counterparties.

For investors and users relying on stablecoins, the episode serves as a reminder of the hidden frictions in governance-heavy models. While the project’s backing by a major stablecoin issuer—Tether—adds a layer of credibility, the immediate depeg demonstrates how quickly trust can erode when safeguarding critical private keys and governance rights falter. For participants, the questions are: what changes will StablR implement to harden its multisignature framework, how quickly will reserves be audited and disclosed, and what protections will be offered to users hurt by the depeg?

Broader security landscape: private-key exploits persist in DeFi

The StablR incident sits within a wider tapestry of security breaches this year that center on compromised keys and governance weaknesses. A sequence of recent exploits—Volo Vault, Wasabi Perps, Echo Protocol, and Polymarket—have all involved some manipulation of admin or private keys. Analysts warn that as DeFi ramps up, so do the attack surfaces tied to governance and access management. In parallel, Map Protocol—an Atlantis-style cross-chain map project—was breached when a smart contract vulnerability allowed an attacker to mint a quadrillion MAPO tokens, illustrating a spectrum of technical and governance flaws across ecosystems.

These events collectively highlight a recurring tension in DeFi: rapid innovation and high open access can outpace the development of secure, scalable governance and key-management practices. Industry observers argue that improving multi-party computation, hardware-backed key storage, formalized incident-response playbooks, and enhanced rotation and revocation protocols will be essential as protocols grow larger and more interconnected.

Notable coverage and updates from the security and analytics community, including PeckShield’s alerts and DeFi-focused trackers, continue to document the evolving risk environment. As the market digests ongoing fallout, users will be watching for tangible remedies from projects like StablR—clarified governance changes, enhanced key-management controls, and transparent post-incident disclosures that can help stabilize confidence and liquidity in the face of depeg events.

In this climate, the market remains vigilant for how quickly teams can respond to breaches, how robust their reserve disclosures remain, and what steps are taken to prevent recurrence. With May’s incidents accumulating, the sector could see accelerated adoption of best practices around governance hygiene, key security, and incident preparedness—outcomes that could ultimately contribute to a more resilient stablecoin ecosystem.

There were no updates on the StablR X feed at the time of writing, leaving stakeholders awaiting formal post-incident disclosures and the path forward for recovery. For those tracking the evolving DeFi security landscape, the StablR episode is a concrete reminder that governance design and key-management protocols are no less critical than code quality when it comes to protecting user funds.

As the story develops, readers should watch for StablR’s official incident report, any changes to its multisignature configuration, and forthcoming audits or proofs of reserves that could help restore trust. The broader question remains: will the industry tighten the screws on key management fast enough to prevent similar breaches from repeating across the expanding DeFi frontier?

France is grappling with a troubling rise in wrench attacks—violent robberies aimed at crypto holders to steal digital assets. Bitcoin journalist Joe Nakamoto estimates that roughly 70% of these incidents occur in France, a figure he links to the country’s centralized data practices and the exposure of personal information in data breaches.

According to Nakamoto, 41 crypto-related kidnappings have been recorded in France so far in 2026, equating to about one attack every two and a half days. The surge, he argues, is fueled by compromised Know-Your-Customer data stored on centralized servers, exposing home addresses and other personally identifiable information that attackers can weaponize against individuals holding crypto.

The ledger of data abuses in the crypto ecosystem further underscores the vulnerability. Nakamoto notes the 2020 Ledger data breach, which exposed the identities, home addresses and emails of more than 270,000 customers worldwide, as a watershed moment in the risk landscape for holders. In a candid appraisal, Jameson Lopp, CEO of Casa, described France as “the canary in the coal mine,” suggesting that financial regulations surrounding data and privacy can unintentionally magnify harms to bitcoin holders.

France is the canary in the coal mine, demonstrating how financial regulations create a surveillance apparatus that causes direct harm to bitcoin holders.

As the crypto community weighs the implications of these events, opposition to broad data collection and centralized storage of user information has intensified. The wrench-attack phenomenon continues to unfold even as authorities pursue individuals involved in these crimes and as calls for heightened security measures by custodians and the broader industry grow louder.

Key takeaways

• About 70% of wrench attacks are reported to occur in France, a trend linked to centralized KYC data practices and subsequent data breaches.
• In 2026, Nakamoto estimates 41 crypto-related kidnappings in France, roughly one attack every 2.5 days.
• The Ledger data breach in 2020 exposed the identities, home addresses and emails of more than 270,000 customers, highlighting the risks of centralized crypto data stores.
• Industry voices stress practical safeguards for holders, including custody features to verify active attacks, asset freezing capabilities, and strategic use of decoy wallets.
• France reports ongoing enforcement actions, with at least 88 individuals arrested in connection with wrench attacks, signaling continued legal pursuit of perpetrators.

Wrench attacks, data exposure, and what it means for holders

The attacks described by Nakamoto are typically coordinated by criminals operating from abroad, who recruit local associates in France to execute physical raids on crypto owners. This pattern complicates policing and raises the stakes for individual security practices. In response, custodial and key-management providers are increasingly advocating layered defense mechanisms that can be activated in real time when a crisis is detected.

Among the recommended measures is the use of custody services that incorporate a pre-agreed security word or phrase. Such a credential can alert a custodian or asset manager that an attack is underway, enabling rapid asset freezes to prevent unauthorized access and, when appropriate, the timely involvement of law enforcement. The approach aims to curb the immediate theft risk while preserving the possibility of recovering assets through official channels.

Experts also emphasize practical risk-reduction techniques, including maintaining a “decoy” wallet with a small balance that can be handed over if confronted by attackers, thereby reducing the likelihood of a larger loss from a direct confrontation. The broader guidance urges holders to minimize public visibility of their holdings—avoiding overt disclosures online that could flag them as targets—and to coordinate with trusted security partners to establish incident-response playbooks.

For researchers and practitioners tracking these incidents, a community-maintained resource has emerged to catalog known wrench attacks and support risk assessment efforts. The repository at jlopp’s GitHub page documents cases and helps inform safer practices across the ecosystem: GitHub.

Public safety and regulatory responses continue to unfold in France. Vanessa Perrée, the national prosecutor for organized crime, has indicated that at least 88 individuals have been arrested in connection with crypto wrench attacks. The figures underscore a sustained law-enforcement focus on the intersection of physical crime and digital asset ownership, as authorities seek to deter attackers and reassure the crypto community.

Industry observers argue that France’s experience highlights a broader tension in crypto security: the balance between regulatory data requirements and the protection of individual privacy. The push for more stringent data controls and tighter security standards for custodians could help blunt the ability of criminals to identify and premeditate attacks, though critics contend that such measures must not come at the expense of legitimate financial privacy and innovation.

Looking ahead, investors, users and builders will want to monitor both policy developments and practical security enhancements. If the data-privacy debate tilts toward greater protection, we could see a reduction in targeted wrench attacks alongside improved incident-response capabilities from custodians. If, however, data vulnerabilities persist or regulatory regimes inadvertently widen surveillance reach, the risk profile for crypto ownership could remain elevated, especially in jurisdictions with dense central-data ecosystems.

Readers should keep an eye on how custodians evolve their safety features, how law enforcement collaborations evolve, and whether new regulatory frameworks emerge to strike a more robust balance between privacy and security in crypto ownership. The evolving dynamics will shape risk management strategies for individuals and institutions alike in the months ahead.

TLDR:

• • Binance’s 51 TradFi perp pairs generated $60.3B of the exchange’s $585.3B total weekly perp volume.
  • Energy leads TradFi perp penetration in May, with Brent crude alone reaching 10.4% of global equivalent volume.
  • Equity perps show rapid adoption — CBRS hit 1.7% market share within four days of its Nasdaq listing
  • TradFi perp composition shifted from 96% metals in February to a diversified mix of energy, equities, and metals.

Binance’s traditional finance (TradFi) perpetual futures volume has grown from virtually nothing six months ago to over $60 billion weekly.

According to Binance Research data published recently, TradFi perps now account for 10.3% of the exchange’s total perpetual futures market.

The shift marks a notable development in how global traders are accessing traditional asset exposure through crypto infrastructure.

From Metals-Dominated to a Diversified TradFi Market

In February, precious metals made up roughly 96% of Binance’s TradFi perp volume. By May, that share had dropped to around 50%, with energy contracts accounting for 30% and equities at 21%.

The change came as the exchange expanded its product lineup across asset classes. Binance Research noted that CBRS, a Nvidia challenger listed on Nasdaq, launched on May 18 and quickly entered the mix.

As a result, the TradFi perp book now spans a broader range of global market exposure. Energy leads in penetration, with Brent crude alone reaching 10.4% of equivalent global spot and futures volume in May.

Silver peaked at 11.5% of global volume in March, while crypto-linked equities like Circle (CRCL) hit 9.2% of global volume in April. The average market share across all 51 TradFi pairs currently stands at 1.3%.

That average is still modest, but the trajectory across asset classes is upward. Traders are clearly using Binance’s TradFi perps as an alternative access point to global markets.

The diversification away from metals suggests growing confidence in the product structure across energy and equity instruments. It also points to an expanding user base looking beyond crypto-native products.

The pace of adoption across equities and ETFs has been uneven but shows clear pockets of traction. EWY, the South Korea ETF, saw daily volume spike to roughly 4% of global equivalent volume on two separate occasions. SNDK peaked at 2.0% with $500 million in daily volume, around 20 times its April average.

Early-Stage Equity Perps Show Pockets of Traction

MU, the memory chip maker, is still below 1% market share but is now generating $391 million per day, roughly 35 times its April average. CBRS reached 1.7% market share within just four days of its Nasdaq listing.

These figures come directly from Binance Research’s thread published on May 24. The speed of adoption for new equity listings is notably faster than what was seen with metals in early 2026.

This acceleration matters because it shows that Binance’s TradFi perp infrastructure is now responsive to new listings. When a new equity goes live, traders are finding the product and taking positions quickly.

That kind of latency compression between listing and adoption was not present in February. It reflects growing familiarity with the product among traders across global time zones.

Binance Research stated in its thread that TradFi perps have “crossed from experimental category to a structural source of global TradFi liquidity.” That transition is supported by the data across metals, energy, and equities.

The week ending May 24 saw 51 TradFi pairs generate $60.3 billion out of Binance’s total $585.3 billion in perp volume. That ratio, just over one in ten dollars, is likely to grow as more instruments are listed and traders build familiarity with the format.

TLDR:

• OpenAI and Anthropic make up over half of Big Tech’s $2 trillion future cloud backlog combined.
• Microsoft’s $13B OpenAI investment returned as cloud credits, then recorded as fresh revenue by Microsoft itself.
• Alphabet’s Q1 2026 record profit included $28.7B in unrealized paper gains tied to its Anthropic stake.
• Oracle has 54% of its entire $553 billion pipeline dependent on a single AI startup, OpenAI.

The AI revenue loop is drawing fresh scrutiny as analysts examine how major tech companies account for investments in AI startups.

Corporate filings reveal that OpenAI and Anthropic together account for more than half of the $2 trillion cloud backlog held by Microsoft, Oracle, Google, and Amazon.

Critics argue this structure relies on circular financial flows rather than organic market demand.

How the Round-Trip Revenue Model Works

A pattern has emerged across several major investment deals in the AI sector. A tech giant provides billions to an AI startup, often in the form of cloud credits rather than direct cash. The startup then uses those credits to rent computing infrastructure from the same company that funded them.

BullTheoryio described the arrangement plainly: “A tech giant gives billions of dollars to an AI startup as an ‘investment’. But hidden in the contract is a strict rule forcing the startup to hand that exact same money straight back to the tech giant to rent their computer servers.”

Microsoft’s $13 billion investment in OpenAI followed this structure. The funds came as cloud credits, which OpenAI spent on Microsoft’s servers. Microsoft then recorded that usage as cloud revenue from a paying customer.

OpenAI’s cloud spending has grown to over $60 billion annually, more than double its reported revenue of $25 billion. The gap is covered by continued recycled investment flows rather than external customer income.

Paper Profits and Real Cash Gaps Tell Two Different Stories

Beyond cloud revenue, tech companies are recording large paper gains tied to startup valuations. Each new funding round at a higher valuation triggers a mark-up on the investor’s books, which gets counted as profit.

In Q1 2026, Alphabet posted $62.6 billion in profit. However, $28.7 billion of that figure came from a paper markup on its Anthropic stake.

Amazon reported $30.3 billion in profit the same quarter, with $16.8 billion attributed to an unrealized Anthropic valuation gain.

Meanwhile, Amazon’s free cash flow fell 95% to just $1.2 billion, as the company spent $44.2 billion building physical data centers. The contrast between reported profits and actual cash positions is stark.

The concentration risk is also notable. Microsoft has 49% of its $627 billion future backlog tied to OpenAI. Oracle has 54% of its $553 billion pipeline linked to the same company.

Analysts have drawn comparisons to the 2001 dot-com collapse, when Global Crossing and Qwest Communications swapped fiber-optic capacity to manufacture fake sales.

Qwest later erased $1.4 billion in revenue, and Global Crossing filed for bankruptcy. Unlike those cases, the current AI accounting structures remain fully legal under existing rules.

Bitcoin’s price action has traders recalibrating expectations after a key price zone came into focus this week. The market briefly violated a critical cushion around $75,000 to $76,000, prompting veteran analysts to reassess whether the sell-off marks the start of a larger correction or a temporary dip within a broader range.

Crypto market strategist Michaël van de Poppe flagged the move as meaningful, noting that corrections occurring on Fridays often flip back to bullish just as quickly. He also highlighted the existence of multiple CME Bitcoin futures gaps above current spot levels, with the widest gap sitting above $79,000, suggesting potential magnet points for price as the market seeks to fill those inefficiencies.

“If Bitcoin doesn’t grind back upwards to $76,600 or more, then there’s clearly no argument to assume that we are going to get into new highs and just remain within this range.”

The observation comes as the macro backdrop remains unsettled, with regulatory and policy uncertainty clouding the near-term trajectory. The Federal Reserve’s leadership and how future rate decisions unfold are shaping risk sentiment, even as Bitcoin’s bear market persists through a seventh month of drift.

The broader context includes a mix of trader sentiment and on-chain dynamics that are offering a counterpoint to the price action. A live market snapshot shows ongoing debate among market participants about whether the recent rally that extended roughly 90 days off the February low is sustainable or merely a consolidation before renewed downside pressure.

One notable data point gaining attention is the on-chain composition of Bitcoin holders. Recent analysis indicates that long-term holders now control roughly 71% of the circulating supply, a statistic that market observers say reduces the likelihood of a sharp drop below key support levels like $60,000. This crowd of investors has historically provided a stabilizing floor, even as spot price oscillates in the high-$60,000s to mid-$70,000s range.

On the technical side, Bitcoin remains below major moving-average benchmarks that many traders watch for trend changes. Data from TradingView shows BTC trading well under the 365-day and 200-day exponential moving averages, with a close below the 50-day EMA recorded on Friday. Taken together, price action still sits at the crossroads of a potential breakout versus further consolidation.

Across market commentary, the mood is nuanced. Some analysts point to a possible bull-market restart given the persistence of a multi-week uptrend since the February low, while others caution that the market could enter months of range-bound trading if the price fails to reclaim critical levels.

In a separate view of market odds, the Polymarket platform currently assigns a roughly 51% probability to Bitcoin reaching $55,000 in 2026, with around a 31% chance of a drop to $45,000. While not a price forecast, the odds reflect divergent expectations among participants about how the macro cycle and on-chain dynamics will unfold over the coming years.

From an on-chain perspective, the narrative around long-term holders remains a focal point. The sector experience data suggest that a substantial majority of the supply is controlled by investors who have held positions through prior cycles, reinforcing a belief among supporters that a sustained break below major levels would require a material shift in fundamentals or external catalysts.

Key takeaways

• Bitcoin breached the nearby support zone around $75,000–$76,000, raising the stakes for a quick reclaim to maintain upside prospects.
• CME Bitcoin futures gaps linger above the spot market, with the largest gap around $79,000, potentially attracting price back to higher levels if those gaps begin to fill.
• On-chain data shows about 71% of circulating Bitcoin is held by long-term holders, implying a floor beneath $60,000 is less likely to give way easily.
• Technicals show BTC trading below the 365- and 200-day EMAs and closed under the 50-day EMA on the latest session, underscoring a cautious near-term stance.
• Traders’ mood remains mixed, with odds markets pointing to a range of outcomes and macro policy uncertainties weighing on momentum.

Market context and what’s next for BTC

The price action sits amid a backdrop of macro policy debate. The appointment of a new Federal Reserve chair, with potential shifts in interest-rate policy, injects an additional layer of uncertainty over the immediate path for risk assets, including Bitcoin. While some market observers expect rate adjustments to follow a cautious trajectory, others warn that policy missteps could trigger sharper risk-off moves across crypto and broader markets.

Against this backdrop, traders are watching for a definitive short-term signal. A reclaim of around $76,600 would be a meaningful bullish pivot, potentially opening the door to renewed tests of resistance near the $80,000 zone and beyond. Conversely, failure to regain that level could reinforce a period of consolidation, with price tethered to the upper bounds of the existing range.

In the near term, attention is also focused on the relationship between price and on-chain behavior. If long-term holders continue to accumulate or maintain a sizable share of the supply, the market could be more resilient to downside shocks, even if price action remains temperate. Conversely, any acceleration of selling from shorter-term traders or a shift in macro momentum could tilt the balance toward a deeper retrace.

Market watchers will also be mindful of the broader sentiment signals that have driven Bitcoin’s recent narrative, including the ongoing discussion around how Friday price action may precede a rebound or further weakness, and how the interaction between fundamental and technical indicators will shape the next leg higher or lower.

Looking ahead, the most salient watchpoints are the price must-hold levels and the reaction to any renewed momentum. If BTC can reestablish footing above the $76,600 threshold and begin filling the nearby CME gaps, the probability of testing higher highs could rise. If not, the market may gravitate toward a period of extended range-bound activity while macro cues remain unsettled and investors reassess risk exposure.

Readers should keep an eye on evolving policy signals, on-chain composition shifts, and key technical thresholds in the coming sessions, as these elements will collectively determine whether the current phase is a pause before another leg up or the onset of a more protracted consolidation.

About 70% of all wrench attacks, physical attacks against crypto holders and their families, carried out in an attempt to steal digital assets, occur in France, according to Bitcoin journalist Joe Nakamoto. 

There have been 41 crypto-related kidnappings in France so far in 2026, Nakamoto said, or about one attack every two and a half days, he added. 

He attributed the rise in wrench attacks to know-your-customer data collection, which is stored in centralized servers that were compromised in several high-profile data leaks, including the 2020 leak of hardware wallet provider Ledger’s customer data.

An overview of wrench attacks in France so far in 2026. Source: Joe Nakamoto

That data leak disclosed the identities, home addresses and emails of more than 270,000 customers worldwide, he added. Jameson Lopp, the CEO of crypto wallet and key management company Casa, said:

“France is the canary in the coal mine, demonstrating how financial regulations create a surveillance apparatus that causes direct harm to bitcoin holders.”

Opposition to know-your-customer data collection is mounting inside the crypto and Bitcoin communities, as digital asset holders continue to be targeted with physical attacks and kidnappings, prompting a need for increased security measures.

Related: Europe sees ‘hyperconcentration’ of crypto wrench attacks as losses hit $101M

Don’t become a target: Bitcoiners offer advice to safeguard against attacks

The attacks are typically orchestrated by criminals living abroad, who contract young people living in France to carry out the physical attacks, Nakamoto said.

Users can stay safe by using crypto custody services that offer security features like a pre-agreed-upon word or phrase that lets a custodial or key management company know the holder is being actively attacked.

A database of known wrench attacks. Source: GitHub

The company can then freeze the assets, making sure they are not accessed by the attackers, and can even alert law enforcement authorities, he said.

He also suggested keeping a “decoy” crypto wallet with a small amount of funds to hand over to criminals in the event of an attack. 

Finally, crypto holders should keep a low profile and not discuss crypto topics online or make it public knowledge that they hold digital assets, he added.

At least 88 individuals have been arrested in connection with crypto wrench attacks in France, according to Vanessa Perrée, the country’s national prosecutor for organized crime.

Magazine: Agent wastes 14 hours of scammers’ time, LLMs ‘poisoned’ by Iran: AI Eye