Echo Protocol Exploited for $76 Million in Unauthorized eBTC Minting on Monad

Echo Protocol suffered an exploit on May 18, 2026, when an attacker minted 1,000 eBTC worth $76.64 million on Monad using a compromised admin key. The attacker collateralized 45 eBTC on Curvance to borrow 11.29 WBTC worth $867,700, then funneled 384 ETH into Tornado Cash. Monad lost about $816,000 in the attack. Echo Protocol suspended all cross-chain transactions while security researchers investigate.

Echo Protocol exploit details

• ▪Keone Hon stated Monad lost about $816,000 to the Echo Protocol exploit
• ▪OnChain Lens confirmed the Echo Protocol attacker still appears to control a significant amount of minted eBTC
• ▪A hacker minted 1,000 eBTC worth $76.64 million on Monad during the Echo Protocol exploit
• ▪Echo Protocol fell victim to an exploit on May 18, 2026
• ▪The attacker's wallet retained 955 eBTC of the fake supply worth approximately $73.2 million after the Echo Protocol exploit

Attacker fund movement strategy

• ▪The Echo Protocol attacker collateralized 45 eBTC on Curvance to borrow 11.29 WBTC worth $867,700
• ▪The Echo Protocol attacker funneled 384 ETH into Tornado Cash
• ▪The Echo Protocol attacker opted against a 1,000 eBTC DEX market dump to avoid severe slippage caused by Monad's shallow liquidity pool

Platform security responses

• ▪THORChain automatically detected abnormal behavior and halted signing activity, which prevented more outbound transactions during the May 15, 2026 exploit
• ▪Other Curvance pools and major cross-chain platforms including Aave, Morpho, Spark, and Fluid were untouched by the Echo Protocol exploit
• ▪Monad Co-founder Keone Hon stated security researchers are investigating the Echo Protocol eBTC incident on Monad

Recent DeFi exploit wave

• ▪Uninsured lending protocols have suffered $7.7 billion in exploit-related losses over the past 6 years according to DeFiLlama
• ▪The DeFi space suffered 13 hacks in May 2026 before the Echo Protocol exploit
• ▪More than $600 million was lost to DeFi hacks in April 2026, with Drift and KelpDAO taking major hits
• ▪The Verus-Ethereum Bridge exploit occurred on May 18, 2026, resulting in the loss of $11.58 million in digital assets
• ▪Blockaid traced the Verus-Ethereum Bridge exploit to the wallet address 0x5aBb…D5777
• ▪The Verus-Ethereum Bridge exploiter made off with 103.6 tBTC, 1,625 ETH, and 147,000 USDC, later converting the assets into about 5,402 ETH
• ▪THORChain suspended trading after the May 15, 2026 exploit
• ▪THORChain was compromised on May 15, 2026, with hackers pocketing more than $10 million

DeFi security vulnerabilities

• ▪Experts suggested the Echo Protocol attacker may have exploited a private key compromise, a deployment error, or a smart contract flaw