Echo Protocol Suffers $77M eBTC Mint Exploit on Monad

Echo Protocol, a Bitcoin liquidity and yield aggregation platform, witnessed a sudden sell-off of 12% ahead of Wednesday’s U.S. market hours to trade at $0.0049. The primary catalyst behind this drop is a major security breach on the eBTC deployment of the Monad blockchain, where the attacker used a compromised administrator key to create 1,000 eBTC tokens. The team promptly halted cross-chain operations linked to Monad to contain the damage, and initiated a full audit of the incident and necessary bridge upgrade.

Echo Protocol Suffers Admin Key Breach on Monad Deployment

Another security incident occurred with the eBTC deployment on the Monad blockchain, where unauthorized tokens were minted, and approximately $816,000 was withdrawn. The incident, which surfaced on May 19, 2026, stemmed from a compromised administrator key rather than a flaw in the underlying smart contracts or the Monad network itself.

Attack Execution and Fund Flows

According to the on-chain data, hackers took control of administrative rights and created around 1,000 eBTC tokens. At current prices, these were valued at a notional $76-77 million. The exploiter deposited a portion—around 45 eBTC—into the Curvance lending platform as collateral. From there, they withdrew WBTC, swapped those tokens to ETH, and sent approximately 384-385 ETH through Tornado Cash to obscure these assets.

Peckshield, among other security firms, monitored the activity and estimated the actual loss at approximately $816,000. After the initial actions, the attacker still had control of about 955 eBTC. Later, the Echo Protocol confirmed that it recovered access to the admin keys, and obliterated all the remaining tokens kept by the opponent.

The Monad network operated uninterruptedly. Co-founder Keone Hon stated publicly that the blockchain infrastructure did not get affected during the event and was working as normal.

Response and Containment Measures

Echo Protocol responded quickly on detection. The team stopped cross-chain operations that are linked to the Monad deployment and upgraded the relevant contracts to enhance the control of sensitive functions and prevent any more unauthorized activities. Bridge functionality across other deployments received additional scrutiny.

As a general precaution, even though no evidence of tampering was found at Aptos bridge, operators completely halted activities there. Echo believes that aBTC on Aptos and eBTC on Monad are non-interoperable assets. Lending markets and liquidity pools in Exposure on Aptos were restricted to approximately $71,000 in total exposure, and there are no confirmed losses at the time of announcement.

The protocol also urged users to stay away from any unofficial websites, refund claims, or recovery pages, emphasizing that only official channels would be used for official communications. The team would not make any requests for private keys or direct transfers.

Echo Protocol Becomes Third Major Breach in Four Days 

The Echo protocol incident follows closely on the heels of other notable breaches. On May 15, THORChain was exploited for an estimated $10.8 million across four chains: Bitcoin, Ethereum, BSC, and Base, which resulted in a temporary pause of trading and signing. The latest drain event on Verus-Ethereum was worth approximately $11.5 million, on May 18. The third major event in only four days is Echo.

The pace is similar to other times this year. Massive losses of over $600 million occurred during April 2026, stemming from a vulnerability in the liquid restaking project KelpDAO through a LayerZero bridge attack and the social engineering attack of Drift Protocol’s decentralized perpetuals exchange that resulted in a loss of $285 million. The losses in the DeFi sector have surged quickly in early 2026, and bridge-related hacks continue to be a frequent vulnerability.

These repeated incidents underscore ongoing challenges around privileged key management, cross-chain messaging, and operational security in DeFi. Even after audits, single points of failure like admin controls (non-multisig) with no timelocks or minting caps are still present in protocols.

Full Security Audit and Bridge Upgrades Underway

Echo Protocol indicated it is conducting a full audit of its Monad deployment, bridge infrastructure, permission structures, minting logic, and operational security practices. External security co-ordination and involvement with ecosystem partners is being carried out to validate the extent of the incident and to establish robust protection measures. Additional upgrades of EVM-series bridge deployments are underway to strengthen cross-chain defenses as well.

The leak seems to be limited to the Monad deployment at the moment. There has been no evidence of broader compromising on the other chains supported by Echo. The market responded, with a downtrend for ECHO and related tokens.

Key Support Levels to Watch As ECHO Price Hits Fresh Low

Since last week, the Echo Protocol coin price has plunged from $0.0072 to current trading value of $0.0049, registering a loss of $36%. Consequently, the asset’s market cap has dropped to $1.56M and the 24-hours trading volume is up 20% to $116.96K, suggesting an aggressive selling pressure.

Amid this downfall, the coin price gave a decisive breakdown below the February 2026 low of $0.0055. As today’s breakdown was primarily fueled from hack-related sentiment, the ECHO price would likely witness notable volatility in the coming days.

The price could potentially rebound from the immediate support of $0.00485 and retest the breached $0.0055 level as potential resistance to check its sustainability for the next move. If the sellers hold this resistance, the ECHO price could plummet another 34% to hit $0.0032.

On the contrary, if the coin price manages to reclaim $0.55 floor, the buyers could attempt its initial recovery leg to $0.077.