Echo Protocol Hit by $76.7M Exploit via Admin Key Breach

An attacker minted roughly 1,000 unauthorized eBTC tokens worth about $76.7 million on Echo Protocol, a decentralized finance platform on the Monad blockchain. Blockchain security firm PeckShield and analytics platform Lookonchain both reported the incident on Tuesday. The hacker has already laundered nearly 5% of the proceeds through Tornado Cash and still holds the remaining 955 eBTC, valued at around $73 million, according to DeBank.

The attacker deposited 45 eBTC, worth approximately $3.45 million, into the DeFi lending and liquidity management protocol Curvance. The attacker then borrowed 11.3 wrapped Bitcoin valued at $868,000 against the deposit, bridged the tokens to Ethereum, swapped them for ETH, and sent 384 ETH worth about $822,000 to the Tornado Cash mixing service.

Echo Protocol stated it is investigating a security incident affecting the Echo bridge on Monad and has suspended all cross-chain transactions. The protocol said it will share updates through official channels. Blockchain developer Marioo reported that the root cause was a compromise of the admin private key and was operational rather than technical. The eBTC contract functioned as designed, but vulnerabilities included a single signature for the admin role, no timelock, no minting supply cap or rate limit, and no supply sanity check by Curvance.

Curvance confirmed it detected the anomaly in the Echo eBTC market, paused the affected market, and found no compromise to its own smart contracts. Monad co-founder Keone Hon clarified that the Monad network remains unaffected and continues to operate normally.

This latest exploit occurs in a month that has already seen at least 12 protocols compromised, including THORChain, Verus Protocol’s Ethereum bridge, Transit Finance, TrustedVolumes, and Ekubo. The year has proven difficult for DeFi security, with dozens of protocols exploited for hundreds of millions in crypto and more than 20 shutting down services. Two of the largest hacks this year were the Drift Protocol exploit, which lost $285 million, and the Kelp DAO exploit, which lost $292 million in April.