EFRI Case Note · StablR Ltd (C 104007), issuer of the e-money tokens EURR and USDR · StablR notice to token holders of 6 November 2026 · Published 6 November 2026

On 6 November 2026, StablR Ltd informed holders of its e-money tokens EURR and USDR that it had filed an application with the Civil Court (Commercial Section) in Malta for its dissolution and consequent winding-up. According to the notice, the shareholders passed an extraordinary resolution to that effect at an extraordinary general meeting on 3 November 2026. They did so “after having received the MFSA’s approval to proceed in this manner”. The notice states that a viable restart or recovery of the business “cannot realistically be achieved”. By choosing dissolution over recapitalisation, the shareholders have in effect declined to cover the losses that EURR and USDR holders now face as a result of the hack.

This follows 165 days in which no holder has been able to redeem a single token. It ends the regulatory phase of the StablR case without any public supervisory decision. The Malta Financial Services Authority (MFSA) has not withdrawn StablR’s authorisation as an electronic money institution: on 6 November 2026, the day the court application was announced, the MFSA’s Financial Services Register still showed StablR Ltd. with the status “Licence Authorised” as a Financial Institution, as an electronic money institution exercising the freedom to provide services outside Malta, and as an “Issuer of EMTs” under the Markets in Crypto Assets sector. The MFSA has not publicly suspended redemption under Article 46(4) MiCAR. It has not publicly determined that the issuer is unable to fulfil its obligations, which is the trigger for the redemption plan under Article 47 MiCAR. What it has done, according to the issuer, is approve a winding-up initiated by the shareholders. From now on, the position of EURR and USDR holders will be decided under Maltese company and insolvency law, not under the holder-protection regime of MiCAR.

This Case Note sets out what the notice says, what it leaves out, which routes the MFSA did not take, and what this means for holders. EFRI’s earlier coverage of the case: EFRI urges MFSA to review StablR’s EMI Licence (7 July 2025), StablR Cyber Incident: What Did the MFSA Supervise? (22 July 2026), StablR: EFRI asks MFSA what became of its 2025 “exhaustive analysis” (24 August 2026) and StablR discloses scale of unbacked tokens one day after EFRI renewed its MFSA request (August 2026).

Background

StablR Ltd (Malta company registration no. C 104007, Birkirkara) holds an electronic money institution authorisation from the MFSA under the Financial Institutions Act (Cap. 376), granted on 21 June 2024, and is registered as exercising the freedom to provide services outside Malta. It issues EURR and USDR as e-money tokens under Title IV MiCAR. Its parent is Plutus B.V., Amsterdam. Tether (December 2024) and Kraken (July 2025) announced minority equity investments in the StablR group. StablR’s chief executive is Gijs op de Weegh, co-founder of the payment service provider Payvision (2002) and its COO until April 2020. StablR’s chief risk officer is Corné van der Meijden, former CFO of Payvision.

Key dates:

• 8 July 2025: EFRI asked the MFSA to review StablR’s authorisation in light of the management’s Payvision history and to obtain the September 2020 supervisory report on Payvision from De Nederlandsche Bank (DNB).
• 1 August 2025: The MFSA replied that it was “currently undertaking an exhaustive analysis” of the submission. EFRI has not been informed of any outcome.
• 24 May 2026: StablR detected irregularities “consistent with unauthorised external access”. According to on-chain analyses by Blockaid and others, the minting function was secured by a 1-of-3 multisignature arrangement. An attacker added their own address as owner, removed the legitimate signers and created tokens without collateral.
• 25 May 2026: StablR suspended minting and redemption. It acknowledged that the circulating supply was “not fully backed at the 1:1 ratio required under MiCAR”.
• 29 May 2026: StablR announced the activation of its recovery plan and its notification of the MFSA.
• 25 August 2026: One day after EFRI renewed its request to the MFSA, StablR disclosed for the first time that approximately 6.41 million EURR and 14.33 million USDR created without authorisation remained in circulation. These figures are materially higher than the May 2026 on-chain estimates (approximately 4.5 million EURR and 8.35 million USDR). The discrepancy has not been explained.
• 29 September 2026: EFRI wrote to the European Banking Authority (EBA), with ESMA, the European Commission, the MFSA and the Spanish CNMV in copy. It asked about the legal basis and permissible duration of the suspension, the trigger for the redemption plan, and the status of the unauthorised units. It also asked the EBA to consider an inquiry under Article 17 of Regulation (EU) No 1093/2010.
• 3 and 6 November 2026: Extraordinary resolution of the shareholders, followed by the court application, as described above.

What the notice says – and what it does not

StablR’s notice of 6 November 2026 makes four statements:

• the incident “remains contained” and no further unauthorised minting has occurred;
• the reserve assets “backing lawfully issued EURR and USDR” continue to be held in segregated accounts, separate from StablR’s own funds;
• “all action taken by the Company in relation to the incident has been under the oversight and in constant communication with” the MFSA;
• the shareholders sought, and received, the MFSA’s approval before resolving to seek dissolution by the Court.

On holders, the notice gives three instructions:

• claims by EURR and USDR holders will be dealt with in the winding-up, under the directions of the Civil Court (Commercial Section);
• holders need take no action at this stage, but should keep records such as wallet addresses and transaction histories;
• holders should not move their tokens to other wallets unless asked to do so as part of the redemption process.

Further updates are to come from the liquidator once appointed. The notice is signed by the Board of Directors.

What the notice does not contain is as significant:

• No figure for the reserve. It does not say whether the segregated assets cover the lawfully issued supply in full, and it does not quantify that supply.
• No mention of the redemption plan under Article 47 MiCAR, the instrument MiCAR designs for this very situation. The notice refers to a redemption process but does not describe one.
• No procedure for holders. It does not tell holders how to establish that their tokens were issued against funds, or by which date and on what basis claims will be assessed.
• Nothing on the unauthorised units. It says nothing about how the roughly 6.41 million EURR and 14.33 million USDR created without receipt of funds will be treated.
• Nothing on the shareholders. It does not say whether the shareholders, or anyone else, will cover the shortfall caused by the issuer’s own security failure.

The routes the MFSA did not take

MiCAR and the Maltese implementation of the E-Money and Payment Services Directives gave the MFSA at least three public routes. As far as is publicly known, it used none of them. StablR’s authorisation remains in force on the MFSA register.

1. Withdrawal of authorisation. Under Article 3(1) of Directive 2009/110/EC read with Article 13(1) of Directive (EU) 2015/2366, implemented in Malta by the Financial Institutions Act, an authorisation may be withdrawn on several grounds. These include an institution ceasing to engage in business for more than six months, no longer meeting the conditions for authorisation, or posing a threat to the stability of the payment system. Six months from the suspension would have elapsed on 25 November 2026. The shareholders resolved to seek dissolution on 3 November 2026. Withdrawal is an administrative act of the authority, preceded by notice and a hearing and resting on stated grounds. It would also have been an express trigger for the redemption plan (Article 47(1) MiCAR; EBA Guidelines on redemption plans, EBA/GL/2024/13, paragraph 81).

2. A decision under Article 46(4) MiCAR. Article 46(4), applicable to e-money token issuers through Article 55, empowers the competent authority to suspend redemption temporarily, provided that the suspension is justified having regard to the interests of the holders and financial stability. No such decision has been published. It is therefore still not publicly known whether the 165-day suspension ever rested on a reasoned decision of the authority, or only on an option the issuer activated itself under its own recovery plan (Article 46(1)).

3. Triggering the redemption plan under Article 47 MiCAR. Under Article 47(1), the redemption plan is implemented upon a decision of the competent authority that the issuer is unable or likely to be unable to fulfil its obligations. The provision expressly includes insolvency and withdrawal of authorisation. Under Article 47(2), the plan must ensure that holders are treated equitably and paid in a timely manner from the proceeds of the remaining reserve assets, including through a temporary administrator where provided for. The EBA Guidelines describe what follows such a decision:

• individual redemption claims give way to an orderly, collective redemption (paragraph 20);
• holders are identified with the help of crypto-asset service providers (paragraph 43);
• holders receive a defined communication strategy and public notice (paragraphs 60 to 65).

By StablR’s own account, the indicators were present from the outset: an acknowledged reserve shortfall, an ICT and governance failure, and the loss of market confidence (cf. paragraphs 80 to 85). No decision under Article 47 has been published.

Instead, the issuer reports that the MFSA approved a winding-up initiated by the shareholders. This produces a different procedure, governed by different rules.

What a court winding-up means for holders

Under the Maltese Companies Act (Cap. 386), the company itself, following a resolution of the general meeting, may apply for dissolution and winding-up by the Court (Articles 214 and 218). Four features matter for holders:

• Interim management. Pending the winding-up order, the Court may appoint a provisional administrator (Article 224). This is the stage StablR’s notice refers to.
• Control passes to a liquidator. Once a winding-up order is made, the directors’ powers cease and a liquidator takes control. According to Maltese practitioner commentary, the Official Receiver is appointed initially. Creditors and contributories may then nominate a different liquidator, and creditors holding at least one quarter of the company’s debts by value may request a change (Articles 229 and 230). Any creditor may complain to the Court about a liquidator’s conduct (Article 243).
• Claims are frozen. Proceedings against the company or its property require the leave of the Court.
• Ranking follows the Civil Code. Claims rank according to the general rules of the Maltese Civil Code, not according to the redemption logic of MiCAR.

Three consequences follow.

First, holders of e-money tokens become creditors. Holders who were promised redemption “at any time and at par value” (Article 49(4) MiCAR) must now lodge claims, prove them and wait. StablR’s own white paper (EURR, version 3.2 of 2 December 2025) told them that “in the event of a recovery scenario, EMT holders remain the right of redemption at 1:1”. Whether and how the redemption plan will be carried out inside the liquidation is not addressed in the notice.

Second, the treatment of the unauthorised units moves to the liquidator. StablR’s own wording, that the reserve backs “lawfully issued” tokens, suggests the issuer regards the segregated assets as belonging to holders of units issued against funds. Under Article 49(3) MiCAR, e-money tokens are to be issued at par and on receipt of funds. The safeguarding regime of Article 54 MiCAR and Article 7 of Directive 2009/110/EC protects funds received in exchange for tokens. Whether a liquidator will apply that distinction, or will instead treat all circulating units of the same designation pari passu, is now an open question of Maltese law. It will be decided by an officeholder subject only to judicial review after the fact.

Third, the composition of the creditor body decides who controls the liquidation. Token holders are dispersed. Many hold through omnibus wallets of crypto-asset service providers, and many cannot readily prove their holdings. Unless holders and their service providers lodge claims and act together, the nomination of the liquidator may be decided by a small number of creditors, potentially including group companies.

The case for the MFSA’s approach

The other side deserves its strongest form.

• A court process is not a lesser remedy. A winding-up by the Court ends the incumbent management’s control and places the company under an officeholder accountable to a judge. It is arguably more robust than an administrative withdrawal, which would have left the same management in charge of the run-off until a redemption plan was triggered.
• The authority cannot compel recapitalisation. No supervisor can force shareholders to fund a deficit caused by a third-party attack. Where the shareholders decline, an orderly liquidation may be the only realistic outcome.
• Confidential action may have been taken. The MFSA may have exercised powers it is not required to publish. Its approval of the winding-up route may itself reflect a judgement that a court process, rather than a redemption plan carried out by the issuer, best serves the holders.
• The redemption plan may still be implemented. Nothing in MiCAR prevents it from being carried out through a liquidator, who could act as the temporary administrator Article 47(2) contemplates.

Each of these points may be correct. None of them can be verified, because none of them has been stated publicly by the authority responsible.

Our Assessment

EFRI is not surprised. In July 2025, EFRI asked the MFSA to examine whether the people running StablR were fit and proper to run an e-money institution, given their record at Payvision. Payvision was the payment service provider through which, on EFRI’s analysis, around EUR 340 million of losses suffered by more than 60,000 victims of online investment fraud were processed. The MFSA announced an “exhaustive analysis”. Fifteen months later, its outcome has still not been disclosed.

Ten months after that announcement, StablR’s minting function was taken over through a single compromised key. Holders have been unable to redeem for 165 days, while the issuer’s public materials continued to describe the tokens as fully backed and redeemable at par. Now the shareholders have decided that the business cannot be saved, and the authority has approved their exit.

Once again, it is consumers who bear the loss. The shareholders’ liability is limited to their capital. The management moves from the boardroom to the role of witnesses. The authority has issued no public decision that could be reviewed. The holders, who bought a product that EU law designs to be redeemable at par at any time, are left to file claims in a foreign insolvency court and wait for a liquidator to decide whether their tokens count.

This is not what MiCAR promised. The redemption plan exists precisely so that the failure of an e-money token issuer is handled as an orderly, collective redemption with equitable treatment of holders, and not as an ordinary corporate insolvency. A regulator that approves a winding-up while never having published a decision under Article 47 has, in substance, let MiCAR’s central holder-protection mechanism go unused when it was needed.

EFRI therefore calls for the following:

1. The MFSA must state publicly whether it has taken a decision under Article 47 MiCAR, and whether the redemption plan will be carried out within the winding-up, by whom and on what timetable. It must also state on what legal basis the suspension of redemption was maintained from 25 May 2026.
2. The reserve and safeguarded assets must be treated as ring-fenced for holders of units issued against funds. A verifiable on-chain snapshot of the block preceding the first unauthorised creation of tokens must be secured and published.
3. The provisional administrator and the liquidator must be independent of StablR, its group companies, its shareholders, its auditors and its advisers. The incumbent management must not be engaged to run the process.
4. Crypto-asset service providers that distributed or hold EURR and USDR must certify their clients’ positions as at 23 May 2026 and support those clients in lodging their claims.
5. The EBA should examine whether the handling of this case is consistent with Articles 46, 47, 49 and 55 MiCAR. That includes the question raised in EFRI’s letter of 29 September 2026: whether an inquiry under Article 17 of Regulation (EU) No 1093/2010 is warranted.

StablR tells holders that no action is required of them at this stage. EFRI disagrees. The winding-up will determine who is paid from the reserve, and the early stage is when the interim administrator and the liquidator are chosen. Holders who are not organised at that point will have little say in how the reserve is distributed. EFRI asks holders of EURR and USDR, in particular those who acquired their tokens before 24 May 2026, to secure their purchase records and custody statements now and to contact EFRI at [email protected].

---

Sources: MFSA Financial Services Register, entry STABLR LTD. (Authorised Person ID STAB, C 104007), authorisations “Financial Institution”, “Local Financial Institutions licensed to issue electronic money … exercising the freedom to provide services outside Malta” and “Issuer of EMTs” (consulted 6 November 2026); StablR Ltd, notice to the community and token holders, 6 November 2026; StablR notices of 25 May, 29 May and 25 August 2026; EURR white paper v3.2, 2 December 2025; MFSA letter to EFRI, 1 August 2025; Regulation (EU) 2023/1114 (MiCAR), Articles 46, 47, 49, 54, 55; EBA Guidelines on redemption plans (EBA/GL/2024/13); Directive 2009/110/EC, Articles 3 and 7; Directive (EU) 2015/2366, Article 13; Companies Act (Cap. 386), Articles 214, 218, 224, 229, 230, 243; Financial Institutions Act (Cap. 376).