Stablecoin Risks and How to Assess Them

The word “stable” in the product name misleads a lot of people. Stablecoins are designed so their value does not move, but a design goal is not the same as an outcome. Two stablecoins can both claim a one-to-one value and still be worlds apart in quality.

The differences sit in places the price never shows you. What the reserves actually hold, who is holding them, whether you can genuinely redeem, and what happens if the issuer runs into trouble. Those four questions, and a few more below, are what decide whether a stablecoin is safe to use. Almost all the evidence is public, and reading it does not require a technical background.

Why stablecoins still carry risk

In How a Rupiah Stablecoin Works we broke the mechanism into three layers: the peg as the reference value, the backing that stands behind it, and minting and burning as the supply control. Risk exists because all three layers are run by people and machines that can err, neglect, or fail outright.

A bank holds the money. An accountant checks the books. Code issues the tokens, a blockchain records them, and a regulator supervises the whole arrangement. Each of those has its own way of breaking, and the ones with the largest consequences come first.

Reserve risk: what is actually in the vault

The reserves of a fiat-backed stablecoin can hold a wide range of things. Bank cash and short-term government securities are the easiest to turn back into money. At the other end sit corporate debt, loans to affiliated parties, and assets with thin markets. All of them count toward the reserve total, and not all of them can become cash in a day.

The gap only shows up when many people withdraw at once. What usually trips an issuer in that situation is not a shortage of assets but the speed of converting them. The reserve figure can look perfectly adequate on paper while the issuer still fails to meet redemptions, because the assets take time to sell and selling in a hurry pushes their price down.

Three things are worth reading in a reserve report. First, its composition: what share is cash and cash equivalents, what share is government securities, what is left over. A large “other” category with no breakdown is a question, not an answer. Second, the ratio against tokens in circulation, which should be at least one hundred percent. Anything below that means some tokens are not fully backed. Third, the publication date, because reserve composition can shift considerably over twelve months, and an annual report hands you a snapshot that went stale long ago.

Attestation and audit get used interchangeably, though their scope differs. An attestation is a limited examination by an independent accountant of the reserve position on one specific date. An audit covers a period and the processes behind it, not a single snapshot. Both are useful, but they do not carry equal weight, and an issuer offering only an attestation should not be read as fully audited.

Issuer and custodian risk

Good reserves still depend on who is holding them.

If reserve funds are mixed with the issuer’s operating cash, the fate of your money is tied to the health of that business. The moment the company runs into trouble, the reserves can be pulled into creditor claims. Segregated accounts, or custody with a third party, are what break that link.

The next layer is the bank where the money sits, and this is the one people most often miss. A stablecoin can be run carefully and still be shaken because one bank holding part of its reserves gets into trouble. A real example appears further down.

There is also an issuer policy worth knowing about from the start. Stablecoins subject to financial regulation generally include a freeze function, letting the issuer freeze balances at specific addresses on the instruction of law enforcement or when funds are linked to a hack. A function like this comes with regulated products, and it does reduce the censorship resistance that crypto assets are often praised for.

Finally, redemption access. On many stablecoins, direct redemption with the issuer is open only to verified institutional parties, while retail users exit through exchanges or partners. That means your way out depends on market liquidity, while the issuer’s redemption promise applies to someone else. Make sure you know which route applies to you before you actually need it.

Market risk and depegs

A depeg is when the market price of a stablecoin drifts away from its reference value. The term gets used for two very different situations, and telling them apart matters.

Shallow, short depegs are ordinary. A price of Rp995 or Rp1,005 on an exchange appears because supply and demand move, then closes again through arbitrage within minutes or hours. As long as the redemption route is open and fast, a gap like this closes on its own.

Deep and prolonged depegs are another story. If the price holds well below the reference for days, arbitrage is not working, and that almost always points to troubled reserves or a redemption route that has been closed, slowed, or priced in a way that makes arbitrage not worth running.

Secondary market liquidity appears in no reserve report anywhere, though its effect is immediate. A stablecoin with thin trading volume can leave you unable to exit a large position without moving the price yourself. Check it through order book depth on the exchange where you plan to sell.

Technology risk: smart contracts, bridges, and networks

A stablecoin token lives as a smart contract on a blockchain, and that code carries risks of its own, separate from anything to do with reserves.

Vulnerabilities in contract code can be exploited. A security assessment by an independent firm helps close those gaps, but read it for what it covers: a code audit answers whether the program is safe, while the existence of reserves is checked through a different document entirely. A token can have flawless code and inadequate reserves at the same time.

Mint and burn authority belongs to this layer too. If the power to create tokens rests on a single key, one leak can be fatal. A multisignature wallet requires several approvals at once, so no single leaked key is enough.

Cross-chain bridges are a weak point in their own right. One stablecoin often exists on several blockchains so it can be used in more applications, and moving between them goes through a bridge. Several of the largest exploits in crypto history happened at bridges rather than in the tokens crossing them. If you do not need to move between networks, there is nothing to gain by adding that exposure.

The network itself can also fail, whether through an outage, congestion, or a spike in transaction fees. When that happens your tokens are still there, but your ability to move them is impaired at exactly the moment you may need it most.

Regulatory and compliance risk

Digital asset rules in Indonesia are changing, and that change is itself a risk worth counting.

Law No. 4 of 2026 on the Amendment to Law No. 4 of 2023 on the Development and Strengthening of the Financial Sector places crypto assets under the supervision of the Financial Services Authority (OJK) and requires business licensing for the parties operating in the sector. Technical provisions on reserves and issuer obligations are not set out in the law itself but delegated to implementing regulations. The detailed framework is still forming, and rules that have not yet been issued can still change how a product operates later.

Two practical consequences follow. An issuer’s licensing status can change, so a product circulating freely today may face new requirements. And there is a meaningful difference between the phrases “compliant with regulation”, “in the licensing process”, and “licensed”. Marketing material often presents the three as equivalent when their legal consequences are not. Read the exact words an issuer uses, because a general impression from marketing material carries no legal weight.

One boundary applies to every user. The sole legal means of payment in Indonesia is the Rupiah. The Elucidation of Article 213 paragraph (1) letter h of Law No. 4 of 2026 states:

Stablecoin tidak dapat digunakan sebagai alat pembayaran secara langsung. Penggunaan stablecoin sebagai alat transaksi tidak dimaknai sebagai alat pembayaran.

Unofficial translation: “Stablecoins may not be used directly as a means of payment. The use of stablecoins as a means of transaction is not construed as a means of payment.” The Indonesian text is retained because the law has no official English version. The same Elucidation allows stablecoins to be used as a means of transaction after a recommendation from the exchange and approval from OJK. What that distinction means in practice is covered in Why Does Indonesia Need a Rupiah Stablecoin?

The risks on your own side

Plenty of the losses stablecoin users take have nothing to do with product quality.

Wrong contract address is the most common. Fake tokens with identical names and symbols are easy to create on any network. Take the contract address from the issuer’s official documentation, not from search results or a message someone sent you.

Wrong network happens often too. Sending tokens to a correct address on the wrong chain can put the funds beyond recovery.

Then there are scams trading on the stablecoin name. High fixed yields offered on stablecoin deposits are a recurring pattern. Stablecoins themselves generate nothing. The yield comes from whoever is lending or deploying your money, and that is where the risk sits. When an offer describes its returns as guaranteed, the risk is still somewhere in the structure, you are simply not being told about it.

Finally, wallet security. A leaked recovery phrase makes every safeguard on the issuer’s side irrelevant.

Two cases worth studying

The first is the collapse of UST in May 2022. UST was a stablecoin that held its value through an algorithm, with no equivalent reserves behind it. When market confidence went, the mechanism accelerated the collapse instead of arresting it, and the value was gone within days. A peg that cannot be redeemed against anyone has no basis to hold when markets panic, and since that episode the uncollateralized model has effectively been abandoned for serious use.

The second happened in March 2023, when Circle, the issuer of USDC, disclosed that roughly 3.3 billion US dollars of its cash reserves were stuck at Silicon Valley Bank, which regulators had just closed. USDC briefly fell to around 0.87 dollars. Once US regulators guaranteed deposits at the bank and the funds became accessible, the price recovered within days.

The second case is the more useful one to study precisely because it ended well. The reserves were real, full, and openly reported. What failed was a single bank holding part of them. So asking whether the reserves exist is not enough on its own. You also need to know where those reserves are placed and how widely they are spread.

A ten-minute framework for assessing any stablecoin

These seven questions are enough to assess any stablecoin, including ones not referenced to the Rupiah.

What to check	The question	Where to find it
Issuer	What legal entity is it, and what is its licensing status in Indonesia	Issuer’s official site, OJK’s official channels
Backing model	Fiat-backed, crypto-backed, or algorithmic	Product documentation
Reserve composition	What share is cash and government securities against other assets	Transparency report or attestation
Examiner	Who is the accountant or auditor, and when was the last report published	The same report, check the date
Redemption	Who can redeem directly, on what terms and at what cost	Product documentation and terms of service
Supply	Does the circulating token count match the reserves reported	Block explorer, compared against the report
Code	Has the smart contract been through an independent security assessment	The issuer’s security audit report

If you cannot find an answer to one of them, that absence tells you something too. An issuer running the product seriously puts all seven answers somewhere easy to reach, since openness is part of what the product is selling.

Warning signs to walk away from

• Fixed yields promised on stablecoin deposits, particularly at rates well above bank deposit interest
• Reserve reports that never appear, or appear without naming the examining accountant
• Reserve composition where most of the total falls into a category with no breakdown
• An issuer whose legal entity is unclear or whose jurisdiction is not disclosed
• Redemption that is suddenly restricted, slowed, or hit with new fees
• A claim of being “licensed” with no mention of which licence, from which authority, under what number
• Token supply on the blockchain exceeding the reserves reported

What protects you in Indonesia

A stablecoin is not a bank deposit. Your money is not guaranteed by the Deposit Insurance Corporation (LPS), and no mechanism returns your value if the issuer fails.

What does exist is a supervisory framework. Law No. 4 of 2026 places crypto asset operators under OJK business licensing, with obligations covering governance, risk management, information system security, and consumer and personal data protection. That framework lowers the chance a careless issuer can operate and gives you a clear route for complaints. What it safeguards is the conduct of the operators. The value of your tokens stays outside its scope.

So the share of your money you place in stablecoins deserves the same consideration as any other allocation, rather than being treated like a savings account.

Where IDRX sits

IDRX is a Rupiah-referenced stablecoin using the fiat-backed model, so the seven questions in the table above apply to it directly.

On the reserve side, the IDRX transparency report is on the official documentation pages, with its publication date shown. On the code side, the IDRX smart contract has been through a security assessment by CertiK, and the report is open to read. The backing model, the issuer, and the redemption route are set out in the product documentation.

Check all of it with the same framework, then compare against any other stablecoin you are considering, using the same seven questions.

Conclusion

Stablecoin risk comes from six directions: what the reserves hold, who holds and issues them, how the market behaves under stress, the code and networks running it, rules that are still changing, and your own habits in using it. No single number summarizes all of that, and a price that looks stable today tells you nothing about the other five directions.

Nearly all the evidence is public. Reserve reports can be read by anyone, on-chain supply can be checked through a block explorer, licensing status can be traced to official channels, and security audit reports are usually published by issuers themselves. Working through it takes about ten minutes. Do it before the money goes in.

FAQ

Can a stablecoin lose all of its value? It can, and it has happened to stablecoins relying on an algorithm with no equivalent reserves. For a fiat-backed stablecoin with full, verified reserves the risk is far smaller, though still not zero, because issuer, custodian, and technology risks remain.

What is a depeg and when should I worry? A depeg is when the market price drifts from the reference value. A shallow gap that closes within hours is ordinary. What deserves attention is a deep gap that holds for days, since it usually signals trouble with the reserves or the redemption route.

Are stablecoins covered by deposit insurance? No. A stablecoin is not a bank deposit and falls outside deposit guarantee schemes. What applies is OJK supervision of the operators, not a guarantee of your token’s value.

Does a smart contract audit mean the reserves are safe? No. A smart contract audit examines the code. The existence and quality of reserves are examined through an attestation or a financial audit. They are different documents and you need to read both.

How do I check a stablecoin’s reserves? Find the transparency report or attestation on the issuer’s official site, check its publication date, review the asset composition, then compare the total reserve value against the circulating token supply recorded on a block explorer.

Why do some services offer interest on stablecoin holdings? Because someone is deploying that money, usually through lending or liquidity provision. The yield comes from that activity, and so does the risk. The stablecoin itself produces no yield.

Is a Rupiah stablecoin safer than a dollar one? Not automatically. The reference currency differs, but quality still comes down to reserves, issuer, audits, and compliance. What does change is that you carry no IDR to USD exchange rate risk when using a Rupiah stablecoin for domestic purposes.

Can I redeem a stablecoin directly with the issuer? On many stablecoins, direct redemption is open only to verified institutional parties. Retail users generally redeem through exchanges or partners. Check the product documentation to confirm which route is available to you.

How much of my money should sit in stablecoins? There is no standard figure, and this article does not offer allocation advice. What holds is that a stablecoin is an instrument for moving and holding value over the short term, not a guaranteed savings product.

References

• Law of the Republic of Indonesia No. 4 of 2026 on the Amendment to Law No. 4 of 2023 on the Development and Strengthening of the Financial Sector, particularly Article 213 and its Elucidation, Article 215, and Article 221A. Official text available via JDIH, peraturan.go.id.
• Law of the Republic of Indonesia No. 7 of 2011 on Currency. Official text available via JDIH, peraturan.go.id.
• Financial Services Authority (OJK), information and regulations on digital financial assets, ojk.go.id.
• Bank Indonesia, provisions on payment systems and financial sector technology innovation, bi.go.id.
• Circle Internet Financial, official statement on USDC reserve exposure to Silicon Valley Bank, 11 March 2023, circle.com.
• IDRX, technical documentation and transparency reports, docs.idrx.co and home.idrx.co/en/docs.
• CertiK, security assessment of IDRX, home.idrx.co/docs/security-assesment-idrx.pdf.

Disclaimer

This article is educational and is not a solicitation to buy, sell, or hold any digital asset. Digital assets carry risk, including the risk of losing value. The legal provisions quoted here can change and may be interpreted differently, so consult the official text of the regulations and a qualified adviser before making any decision. Do your own research.