VERIFIEDBy Xavier Rivera· ·2 min read
Echo Protocol Hit by $76.7M Exploit via Admin Key Breach
An attacker minted about 1,000 unauthorized eBTC worth $76.7 million on Echo Protocol after compromising an admin private key on the Monad blockchain. The incident highlights ongoing DeFi security risks, with at least 12 protocols already exploited this month amid a broader 2026 surge in crypto hacks.
Source:CoinTelegraph
TL;DRAI · 60 sec read
An attacker minted roughly 1,000 unauthorized eBTC tokens worth about $76.7 million on Echo Protocol, a decentralized finance platform on the Monad blockchain. Blockchain security firm PeckShield and analytics platform Lookonchain both reported the incident on Tuesday. The hacker has already laundered nearly 5% of the proceeds through Tornado Cash and still holds the remaining 955 eBTC, valued at around $73 million, according to DeBank.
The attacker deposited 45 eBTC, worth approximately $3.45 million, into the DeFi lending and liquidity management protocol Curvance. The attacker then borrowed 11.3 wrapped Bitcoin valued at $868,000 against the deposit, bridged the tokens to Ethereum, swapped them for ETH, and sent 384 ETH worth about $822,000 to the Tornado Cash mixing service.
Echo Protocol stated it is investigating a security incident affecting the Echo bridge on Monad and has suspended all cross-chain transactions. The protocol said it will share updates through official channels. Blockchain developer Marioo reported that the root cause was a compromise of the admin private key and was operational rather than technical. The eBTC contract functioned as designed, but vulnerabilities included a single signature for the admin role, no timelock, no minting supply cap or rate limit, and no supply sanity check by Curvance.
Curvance confirmed it detected the anomaly in the Echo eBTC market, paused the affected market, and found no compromise to its own smart contracts. Monad co-founder Keone Hon clarified that the Monad network remains unaffected and continues to operate normally.
This latest exploit occurs in a month that has already seen at least 12 protocols compromised, including THORChain, Verus Protocol’s Ethereum bridge, Transit Finance, TrustedVolumes, and Ekubo. The year has proven difficult for DeFi security, with dozens of protocols exploited for hundreds of millions in crypto and more than 20 shutting down services. Two of the largest hacks this year were the Drift Protocol exploit, which lost $285 million, and the Kelp DAO exploit, which lost $292 million in April.
The attacker deposited 45 eBTC, worth approximately $3.45 million, into the DeFi lending and liquidity management protocol Curvance. The attacker then borrowed 11.3 wrapped Bitcoin valued at $868,000 against the deposit, bridged the tokens to Ethereum, swapped them for ETH, and sent 384 ETH worth about $822,000 to the Tornado Cash mixing service.
Echo Protocol stated it is investigating a security incident affecting the Echo bridge on Monad and has suspended all cross-chain transactions. The protocol said it will share updates through official channels. Blockchain developer Marioo reported that the root cause was a compromise of the admin private key and was operational rather than technical. The eBTC contract functioned as designed, but vulnerabilities included a single signature for the admin role, no timelock, no minting supply cap or rate limit, and no supply sanity check by Curvance.
Curvance confirmed it detected the anomaly in the Echo eBTC market, paused the affected market, and found no compromise to its own smart contracts. Monad co-founder Keone Hon clarified that the Monad network remains unaffected and continues to operate normally.
This latest exploit occurs in a month that has already seen at least 12 protocols compromised, including THORChain, Verus Protocol’s Ethereum bridge, Transit Finance, TrustedVolumes, and Ekubo. The year has proven difficult for DeFi security, with dozens of protocols exploited for hundreds of millions in crypto and more than 20 shutting down services. Two of the largest hacks this year were the Drift Protocol exploit, which lost $285 million, and the Kelp DAO exploit, which lost $292 million in April.
HELP US IMPROVE
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.