Echo Protocol, a Bitcoin-focused DeFi platform, was hit by a major exploit on the Monad blockchain that resulted in roughly 1,000 unauthorized eBTC — about $77 million — being minted, security firm PeckShield reported on X.
How the attack unfolded
- The attacker gained control of an admin key and minted the eBTC tokens.
- They then used those tokens as leverage in the protocol’s money market and reward layer at Curvance to borrow wrapped bitcoin (WBTC) worth approximately $3.45 million.
- The borrowed WBTC was routed through the crypto mixer Tornado Cash in an apparent laundering step.
Echo’s response
Echo Protocol says it has regained control of the compromised admin keys and burned the remaining 955 eBTC that the attacker still held. The team has paused cross-chain functionality for the Monad deployment and completed an upgrade to the affected Monad contract to restrict the operations that were exploited and tighten control over sensitive functions.
Broader platform status
Echo primarily operates on Aptos and uses synthetic Bitcoin representations such as eBTC to give users liquidity and yield on BTC holdings. While the Aptos bridge was not directly affected, Echo has paused Aptos bridge operations as a precaution while it conducts a full review.
Industry context
This incident is the latest in a wave of high-value attacks on DeFi platforms. In recent weeks, other protocols including Drift and KelpDAO have suffered exploits that resulted in losses well over $200 million.
Takeaway
The exploit underscores the persistent risks around privileged keys, cross-chain functionality, and composable DeFi integrations. Echo’s rapid recovery of keys and burning of the remaining tokens limits some damage, but the incident will likely prompt renewed scrutiny of key management and cross-chain security across the sector.
Read more AI-generated news on: undefined/news
