Echo Protocol Exploited for $76 Million in Unauthorized eBTC Minting on Monad

May 19, 2026

Echo Protocol suffered an exploit on May 18, 2026, when an attacker minted 1,000 eBTC worth $76.64 million on Monad using a compromised admin key. The attacker collateralized 45 eBTC on Curvance to borrow 11.29 WBTC worth $867,700, then funneled 384 ETH into Tornado Cash. Monad lost about $816,000 in the attack. Echo Protocol suspended all cross-chain transactions while security researchers investigate.

Echo Protocol exploit details

▪Keone Hon stated Monad lost about $816,000 to the Echo Protocol exploit.
▪OnChain Lens confirmed the Echo Protocol attacker still appears to control a significant amount of minted eBTC.
▪A hacker minted 1,000 eBTC worth $76.64 million on Monad during the Echo Protocol exploit.
▪Echo Protocol fell victim to an exploit on May 18, 2026.
▪The attacker's wallet retained 955 eBTC of the fake supply worth approximately $73.2 million after the Echo Protocol exploit.

Attacker fund movement strategy

▪The Echo Protocol attacker collateralized 45 eBTC on Curvance to borrow 11.29 WBTC worth $867,700.
▪The Echo Protocol attacker funneled 384 ETH into Tornado Cash.
▪The Echo Protocol attacker opted against a 1,000 eBTC DEX market dump to avoid severe slippage caused by Monad's shallow liquidity pool.

Platform security responses

▪THORChain automatically detected abnormal behavior and halted signing activity, which prevented more outbound transactions during the May 15, 2026 exploit.
▪Other Curvance pools and major cross-chain platforms including Aave, Morpho, Spark, and Fluid were untouched by the Echo Protocol exploit.
▪Monad Co-founder Keone Hon stated security researchers are investigating the Echo Protocol eBTC incident on Monad.

Recent DeFi exploit wave

▪Uninsured lending protocols have suffered $7.7 billion in exploit-related losses over the past 6 years according to DeFiLlama.
▪The DeFi space suffered 13 hacks in May 2026 before the Echo Protocol exploit.
▪More than $600 million was lost to DeFi hacks in April 2026, with Drift and KelpDAO taking major hits.
▪The Verus-Ethereum Bridge exploit occurred on May 18, 2026, resulting in the loss of $11.58 million in digital assets.
▪Blockaid traced the Verus-Ethereum Bridge exploit to the wallet address 0x5aBb…D5777.
▪The Verus-Ethereum Bridge exploiter made off with 103.6 tBTC, 1,625 ETH, and 147,000 USDC, later converting the assets into about 5,402 ETH.
▪THORChain suspended trading after the May 15, 2026 exploit.
▪THORChain was compromised on May 15, 2026, with hackers pocketing more than $10 million.