Decentralized finance protocol Echo Protocol was exploited after an attacker minted approximately 1,000 unauthorized eBTC on the protocol deployed on the Monad blockchain.
Both blockchain security company PeckShield and analytics platform Lookonchain reported about the incident on Tuesday, noting that the hacker minted 1,000 synthetic Bitcoins (eBTC) worth approximately $76.7 million.
“We are currently investigating a security incident that impacted the Echo Bridge on Monad. All cross-chain transactions remain suspended during the investigation,” Echo Protocol said on Tuesday.
This latest exploit comes during a month in which at least 12 protocols were compromised, including THORChain, Verus Protocol’s Ethereum Bridge, Transit Finance, TrustedVolumes, and Ekubo.
According to PeckShield, the attacker attempted to launder some of the loot by depositing 45 eBTC worth approximately $3.45 million into DeFi lending and liquidity management protocol Curvance.
The attacker then borrowed 11.3 wrapped Bitcoin (wBTC) worth $868,000 against him, merged the tokens with Ethereum, converted them to ETH, and sent 384 ETH worth approximately $822,000 to the Tornado Cash mixing service.
The attacker still holds 955 eBTC worth approximately $73 million, According to to DeBank.
Echo Protocol is a Bitcoin DeFi platform focused on Bitcoin liquidity aggregation, liquidity staking, re-staking and yield generation. It creates unified, liquid BTC assets such as eBTC that users can pool and deploy in DeFi for additional profit. The protocol is implemented on Monad, a high-performance Layer 1 and EVM compliant blockchain.
The hacker still has 95% of the stolen crypto. Source: DeBank
The administrator’s private key has been compromised
Blockchain creator “Marioo” reported that it was not a clever contract error but a compromise of the administrator’s private key, and the root cause was “operational, not technical.”
The eBTC contract “worked exactly as designed,” they said, adding that the vulnerabilities include a single signature for the administrator role, no time lock, no upper supply limit or stake limit, and no “supply stability checks” by Curvance for the freshly minted security.
Related: Hackers used artificial intelligence to create a zero-day attack to bypass 2FA: Google
curve reported that it was aware of an “anomaly” detected in the eBTC Echo market on Curvance and confirmed that there was no compromise with its own clever contracts. It suspended the affected market for investigation.
Monada co-founder Keone Hon explained on X that “the Monad network is not affected and is functioning normally”.
Meanwhile, Echo Protocol said it will provide updates through its official channels as more information becomes available.
The number of DeFi hacks will enhance in 2026
It was a arduous year for DeFi security, including: dozens of protocols were used for hundreds of millions in crypto and over 20 protocol closure services.
Two of the biggest hacks this year involved an exploit Drift protocolwhich lost $285 million, and Kelp DAOwhich was mined for $292 million in April.
On Monday, Verus Protocol’s Ethereum bridge has been exploited via a imitation cross-chain transfer message that allowed the hacker to steal at least $11.6 million worth of cryptocurrencies.
Decentralized liquidity protocol THORChain halted trading on Friday after blockchain researcher ZachXBT flagged a suspect $10 million exploit.
Meanwhile, Transit Finance suffered from an dated clever contract exploit that caused a loss of $1.88 million last week.
Warehouse: DeFi’s billion-dollar secret: the insiders behind the hacks
