Echo Protocol’s eBTC Hit by $77 Million Exploit Linked to Admin Key Breach

The hacker has already laundered nearly 5% of the stolen funds through Tornado Cash and continues to hold the remaining 955 eBTC.

Decentralized finance protocol Echo Protocol was exploited after an attacker minted roughly 1,000 unauthorized eBTC tokens on the protocol, which operates on the Monad blockchain.

Blockchain security firm PeckShield and analytics platform Lookonchain both reported the incident on Tuesday, stating that a hacker minted 1,000 synthetic Bitcoin (eBTC) valued at roughly $76.7 million.

“We are currently investigating a security incident impacting the Echo bridge on Monad. All cross-chain transactions remain suspended while the investigation is underway,” Echo Protocol said on Tuesday.

This latest exploit comes during a month in which at least 12 protocols have been compromised, including THORChain, Verus Protocol’s Ethereum bridge, Transit Finance, TrustedVolumes, and Ekubo.

According to PeckShield, the attacker attempted to launder part of the stolen funds by depositing 45 eBTC, valued at around $3.45 million, into DeFi lending and liquidity management protocol Curvance.

The attacker later borrowed 11.3 wrapped Bitcoin (wBTC), valued at about $868,000, against the assets, bridged the tokens to Ethereum, exchanged them for ETH, and transferred 384 ETH worth roughly $822,000 to the Tornado Cash mixing service.

The attacker is still holding 955 eBTC valued at roughly $73 million, according to DeBank.

Echo Protocol is a Bitcoin-focused DeFi platform centered on Bitcoin liquidity aggregation, liquid staking, restaking, and yield generation. The platform creates unified liquid BTC assets such as eBTC, allowing users to bridge and deploy them across DeFi applications for additional yield. The protocol is built on Monad, a high-performance EVM-compatible layer-1 blockchain.

Admin Private Key Breach Triggers Security Concerns

Blockchain developer Marioo reported that the incident was not caused by a smart contract vulnerability but by a compromised admin private key, adding that the root cause was “operational, not technical.”

They said the eBTC contract “worked exactly as designed,” while noting that the weaknesses included a single-signature admin role, the absence of a timelock, no cap or rate limit on minting, and no “supply sanity check” by Curvance for the newly minted collateral.

Curvance said it was aware of the “anomaly” identified in the Echo eBTC market on its platform and confirmed that its own smart contracts had not been compromised. The affected market was paused for further investigation.

Keone Hon clarified on X that “the Monad network is not affected and is operating normally.”

Meanwhile, Echo Protocol said further updates will be shared through its official channels as additional information becomes available.

DeFi Hacks Rise Sharply Across the Crypto Industry in 2026

The year has proven difficult for DeFi security, with dozens of protocols exploited for hundreds of millions of dollars in crypto, while more than 20 platforms have shut down their services.

Two of the biggest hacks this year involved Drift Protocol, which lost $285 million, and Kelp DAO, which was exploited for $292 million in April.

On Monday, Verus Protocol’s Ethereum bridge was exploited through a fraudulent cross-chain transfer message that enabled a hacker to steal at least $11.6 million in crypto assets.

Decentralized liquidity protocol THORChain halted trading on Friday after blockchain investigator ZachXBT flagged a suspected $10 million exploit.

Meanwhile, Transit Finance was hit by a deprecated smart contract exploit last week, resulting in losses of around $1.88 million.