Breaches and incidentsBriefConfirmed by two or more outlets
Echo Protocol: admin key minted 1,000 unbacked eBTC on Monad
Reported 19 May 2026 by PeckShield and Lookonchain: about 1,000 eBTC minted (notional about USD 76.7M).
- Disclosed
What happened
- Reported 19 May 2026 by PeckShield and Lookonchain: about 1,000 eBTC minted (notional about USD 76.7M). Realized proceeds were far smaller because Monad liquidity was thin: 45 eBTC used as Curvance collateral to borrow 11.3 WBTC (about USD 868K), and about 384 ETH sent to Tornado Cash.
- Root cause: Echo said a compromised admin key affected the Monad deployment. A developer analysis cited a single-signature admin role, no timelock and no mint cap.
- Attribution: none.
- Response: Echo suspended cross-chain transfers and upgraded the Monad contracts. Decrypt quotes Echo saying it regained control of its admin keys and burned the remaining 955 eBTC; Cointelegraph reported the attacker still held them. Curvance paused the market.
Sources
- https://cointelegraph.com/news/echo-protocols-ebtc-exploited-for-76m-in-admin-key-compromise
- https://decrypt.co/368315/bitcoin-defi-platform-echo-protocol-hit-by-76m-monad-exploit
- https://www.theblock.co/news/ecosystems/2026-05-18-echo-protocol-monad-exploit-401771
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.