Echo Protocol pauses bridge after attacker mints $76M eBTC

Bitcoin-focused DeFi platform Echo Protocol has suffered an exploit after an attacker minted roughly 1,000 unauthorized eBTC tokens on the protocol’s Monad deployment.

Blockchain security firm PeckShield and on-chain analytics platform Lookonchain reported on Tuesday that the attacker generated around $76.7 million worth of synthetic Bitcoin tokens tied to Echo’s eBTC asset. 

Early findings shared by multiple researchers indicated that the exploit was not caused by a flaw in Monad itself, but by compromised administrative access linked to Echo’s infrastructure.

Soon after the unauthorized minting, the attacker moved part of the funds into decentralized lending markets. Data shared by Onchain Lens showed that 45 eBTC was deposited into lending protocol Curvance as collateral, allowing the exploiter to borrow around 11.29 wrapped Bitcoin worth nearly $868,000 at the time.

After securing the borrowed assets, the attacker bridged the WBTC to Ethereum, swapped the tokens into ETH, and later routed 385 ETH through Tornado Cash, according to on-chain investigators. PeckShield separately estimated that 384 ETH, worth around $822,000, had already been transferred to the crypto mixing service.

Most of the unauthorized supply remains untouched. Lookonchain and DeBank data showed the attacker still controls about 955 eBTC valued at more than $73 million. 

According to DefiPrime founder Nick Sawinyh stated the remaining tokens appear stranded because Monad’s current lending and decentralized exchange liquidity cannot absorb an exit of that size.

“For anyone using newly-launched lending markets on newly-launched chains, the practical takeaway is narrow: before you supply real assets, look at what the borrowable collateral actually is, who can mint it, and whether anything stops them from minting more. If your lender can’t tell you which keys can produce that collateral, neither can you,” Sawinyh added.

Admin key compromise suspected

While Echo Protocol initially confirmed only that it was investigating a “security incident impacting the Echo bridge on Monad,” blockchain developer Marioo later said the issue stemmed from an admin private key compromise rather than a smart contract failure.

According to Marioo, the eBTC contract itself operated as intended, though several operational weaknesses allowed the attack to escalate. The researcher pointed to the use of a single-signature admin role, the absence of a timelock mechanism, no minting cap or issuance rate limit, and a lack of collateral verification checks on Curvance for newly minted eBTC.

Curvance acknowledged the incident shortly afterward and said the affected Echo eBTC market had been paused as a precaution. The protocol added that its isolated market structure prevented the issue from spreading to other lending pools and stated there was no indication that Curvance’s own smart contracts had been compromised.

On the network side, Monad co-founder Keone Hon said the blockchain itself continued operating normally and had not been breached. 

In a later update, Hon stated that security researchers estimated around $816,000 in actual value had been extracted through the exploit despite the much larger unauthorized mint.

Echo Protocol, which operates as a Bitcoin liquidity and yield platform across multiple chains, including Aptos and Monad, said cross-chain transactions had been suspended while the investigation continues. The team added that future updates would be shared through its official channels.

Several DeFi exploits have transpired in 2026

The exploit has added to a growing list of DeFi security incidents this month alone, including the recent $11.6 million exploit involving Verus Protocol’s Ethereum bridge.

Earlier this year, Drift Protocol lost roughly $285 million in an exploit, while Kelp DAO suffered a separate attack that resulted in losses of about $292 million. 

More recently, THORChain halted trading activity after blockchain investigator ZachXBT flagged a suspected $10 million exploit, while Transit Finance disclosed a deprecated smart contract attack that led to losses of nearly $1.88 million.