Echo Protocol Hit by Monad eBTC Exploit; Loss Estimates Range from $816K to $76.7M
Echo Protocol paused cross-chain functionality on Monad after an attacker minted 1,000 unauthorized eBTC, with the team attributing the breach to a compromised admin key. Source reports differ on the scale: the nominal minted value was about $76.7 million, while Echo put the impacted amount at roughly $816,000.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Unauthorized Minting on Monad
An attacker minted 1,000 unauthorized eBTC on Echo Protocol's deployment on the Monad blockchain, according to on-chain analysts and security firm PeckShield. PeckShield, citing the onchain analyst dcfgod, put the minted position at about $76.7 million. Bitcoinist's reporting likewise described the minting and the extraction of WBTC liquidity through the lending protocol Curvance.
The attacker deposited 45 eBTC (about $3.45 million) into Curvance, borrowed roughly 11.29 WBTC (about $867,700) against it, bridged the WBTC to Ethereum, swapped it for ETH, and sent 384 ETH (about $821,700) to Tornado Cash, per PeckShield.
Disagreement Over the Loss Figure
The sources do not agree on how much was lost. The $76.7 million figure reflects the face value of the minted tokens, which the attacker never fully realized. Echo Protocol's own statement says that "based on current findings, approximately $816K was impacted on Monad," a figure that matches the amount traced to Tornado Cash. Decrypt's headline uses the $76 million number, while its body uses the $816,000 figure. Readers should treat $816,000 as the realized loss reported by the team, and the larger number as the nominal value of unauthorized supply.
Echo's Response and Containment
Echo Protocol confirmed the breach in a Tuesday post, stating its investigation "indicates the issue originated from a compromised admin key affecting the Monad deployment." The team said it regained control of its admin keys and burned the remaining 955 eBTC held by the attacker. It also paused cross-chain functionality on Monad, upgraded the relevant Monad contracts to restrict affected operations, and said the Monad network itself was not affected.
Echo said the incident appears isolated to Monad, with no evidence of compromise on Aptos. Its Aptos-side asset, aBTC, is separate from eBTC and not bridgeable to it, and current Aptos exposure is limited to about $71,000 across Echo lending markets and Hyperion liquidity pools. As a precaution, the team fully paused the Aptos bridge and suspended Echo Aptos Lending, and said it is upgrading its EVM-series bridge deployments.
Security Context for DeFi
The incident follows a familiar pattern in which a single compromised credential unlocks minting privileges across a deployment. Misha Putiatin, co-founder of Symbiotic and of the security firm Statemind, told Decrypt he expects more "Web2.5" attacks targeting centralized key management and operational infrastructure as protocols depend more on off-chain components. He said such systems are more exposed to social engineering than fully permissionless ones.
The breach comes after recent exploits at THORChain and TrustedVolumes, and after a $293 million infrastructure-linked attack on KelpDAO last month, which was attributed to North Korea's Lazarus Group.
Why It Matters
For Traders
Traders with exposure to Echo or eBTC should check whether the realized loss, not the $76.7 million nominal figure, is the relevant number, since the team's containment steps are still in progress.
For Investors
The incident adds to a 2025-2026 run of admin-key and infrastructure compromises, which may push investors to weigh operational security more heavily in DeFi risk assessments.
For Builders
Protocols with privileged minting or off-chain admin keys should review key management and emergency pause controls, since a single compromised credential was enough to mint unauthorized supply here.
This article is for information only and is not financial advice. Read the full disclaimer.
