Echo Protocol Exploit Drains Over $800K After Unauthorized eBTC Minting on Monad

Echo Protocol suffered a security breach on its Monad deployment after an attacker exploited compromised admin credentials to mint 1,000 unauthorized eBTC tokens valued at roughly $77 million, according to blockchain security researchers and the protocol team.

The attacker reportedly used part of the illicitly minted assets to deposit 45 eBTC into Curvance before borrowing approximately 11.29 WBTC worth nearly $868,000 against the collateral. The stolen funds were later bridged to Ethereum, swapped into ETH, and funneled through crypto mixer Tornado Cash, with around 384 ETH — valued at roughly $816,000 — ultimately laundered.

Blockchain security firm PeckShield first highlighted the incident, citing on-chain investigator dcfgod, who tracked the suspicious minting activity and subsequent asset movements across chains.

Echo Protocol later confirmed the exploit, stating that the breach stemmed from a compromised admin key tied specifically to its Monad deployment. The protocol emphasized that the Monad network itself was unaffected and continued operating normally throughout the incident.

The team said it has since regained control of the compromised credentials and burned the remaining 955 eBTC still held by the attacker. Echo also stressed that the issue appears isolated to Monad, with no evidence suggesting its Aptos deployment had been breached.

According to the protocol, its Aptos-based aBTC and Monad-based eBTC are separate assets and cannot be bridged between networks. Current exposure on Aptos was estimated at roughly $71,000 across lending and liquidity markets, with no confirmed losses reported there.

The incident once again highlights a recurring weakness in decentralized finance infrastructure: centralized admin controls and off-chain operational systems. Security experts warned that as DeFi protocols increasingly rely on external infrastructure and key management systems, similar “Web2.5-style” attacks may become more common.

Industry observers noted that operational security, internal infrastructure protections, and admin key management are rapidly becoming just as critical as smart contract audits in defending cross-chain protocols.

Following the exploit, Echo paused cross-chain functionality on Monad, suspended parts of its Aptos operations as a precaution, and upgraded affected contracts to tighten sensitive permissions and minting controls. The team also said it is reviewing bridge infrastructure and cross-chain security mechanisms alongside external security partners.

The breach adds to a growing list of recent DeFi security incidents, including exploits involving THORChain, TrustedVolumes, and the massive KelpDAO bridge attack that was reportedly linked to North Korea’s Lazarus Group.