Echo Protocol Suffers $76M eBTC Exploit on Monad

Echo Protocol, a Bitcoin-focused decentralized finance platform, fell victim to a significant exploit on May 19, 2026, resulting in losses of approximately $76-77 million. According to security firm PeckShield, attackers minted roughly 1,000 unauthorized eBTC tokens on the Monad blockchain by compromising an admin key.

The attack sequence involved the attacker leveraging the compromised admin credentials to mint the tokens, then borrowing $3.45 million worth of wrapped Bitcoin (WBTC) against the minted funds on Curvance. The stolen assets were subsequently laundered through Tornado Cash, a privacy mixer protocol.

Echo Protocol responded swiftly by regaining control of its admin keys and burning 955 eBTC tokens that remained in the attacker's possession, limiting further damage. This incident underscores persistent vulnerabilities in DeFi protocol security, particularly around privileged access controls and key management systems.

The exploit highlights critical risks in [INTERNAL: DeFi security] as platforms scale across multiple blockchain networks. Similar incidents have plagued other protocols, demonstrating that administrative key compromise remains a high-impact attack vector. The use of privacy mixers like Tornado Cash for fund laundering has become standard practice among sophisticated attackers seeking to obscure transaction trails.

Echo Protocol's rapid response in burning remaining unauthorized tokens likely prevented further minting exploits, though the initial damage of $76 million represents substantial losses for users and the protocol. The incident raises questions about multi-signature schemes, key storage practices, and access controls that should be standard across [INTERNAL: DeFi platforms].

The attack also demonstrates the cross-chain risks emerging as protocols expand to newer blockchains like Monad. Ensuring consistent security standards across multiple chain deployments remains a significant operational challenge for DeFi teams.

Disclaimer: Not financial advice.