Echo Protocol Incident Results in $816,000 Loss After Admin Key Compromise

Echo Protocol Admin Key Compromise Leads to $816,000 Loss – Paper Value of $76.7 Million Highlights Structural Weaknesses in DeFi Controls

Key Takeaways

• An attacker minted 1,000 fake eBTC on Echo Protocol’s Monad deployment, representing $76.7 million in nominal value.
• The exploit resulted from a compromised admin key, not a smart contract code flaw.
• The attacker extracted approximately $816,000 in real value through Curvance and Tornado Cash.
• Echo burned 955 fake eBTC and paused affected functions after regaining control.

Compromised Admin Key Enabled Unauthorized Minting on Monad

On May 18, 2026, Echo Protocol identified unauthorized activity involving its eBTC token on the Monad blockchain. An attacker gained access to the DEFAULT_ADMIN_ROLE of the eBTC contract and used it to mint 1,000 eBTC tokens. At the time, those tokens had a notional value of approximately $76.7 million.

Echo later confirmed that the incident was caused by a compromised admin key. The eBTC contract itself, which uses OpenZeppelin’s role based access control system, functioned as designed. However, the DEFAULT_ADMIN_ROLE was controlled by a single externally owned account. Whoever held that private key could grant minting rights and create new tokens.

Using the stolen key, the attacker granted themselves both DEFAULT_ADMIN_ROLE and MINTER_ROLE. They then called the mint function and created 1,000 eBTC. These tokens were not backed by real Bitcoin. After minting, the attacker revoked both the original admin role and their own admin role, reducing immediate on chain visibility of the change.

Monad co founder Keone Hon stated that the Monad network itself was not affected and continued operating normally. The incident was limited to Echo’s protocol layer on Monad.

How $76.7 Million on Paper Became $816,000 in Real Losses

Although 1,000 eBTC were minted, the attacker could not convert the full amount into liquid assets. Liquidity on Monad was limited, which constrained potential exit routes.

Instead of attempting to sell the tokens directly, the attacker used a lending protocol. They deposited 45 eBTC, valued at about $3.45 million on paper, into Curvance as collateral. Curvance is a lending platform on Monad that operates isolated markets, meaning each collateral asset is contained within its own pool.

Curvance accepted the deposited eBTC as standard collateral. From the protocol’s perspective, there was no distinction between newly minted and previously issued tokens. Against this collateral, the attacker borrowed 11.29 WBTC, worth approximately $868,000.

The borrowed WBTC was bridged to Ethereum, where liquidity is deeper. There, the attacker swapped the WBTC for around 384 ETH, valued at roughly $822,000 at the time. The ETH was then sent through Tornado Cash, a sanctioned Ethereum mixing service designed to obscure transaction trails.

According to security researchers cited in the incident, the total real value extracted amounted to approximately $816,000. The remaining 955 eBTC stayed in the attacker’s wallet and were later burned by Echo after the team regained control.

Roles of Echo Protocol, Curvance, and Monad

Echo Protocol is a Bitcoin focused DeFi project offering yield bearing wrapped BTC products. Its primary deployment is on Aptos, where the token is called aBTC. On Monad, the token is branded as eBTC. The two assets are separate and not bridgeable.

The exploit affected only the Monad deployment of eBTC. Echo’s Aptos infrastructure was not compromised, although the team temporarily paused certain functions, including the Aptos bridge and lending, as a precaution.

Curvance, the lending platform used in the cash out process, was not directly hacked. Its contracts functioned according to design. The isolated market structure limited exposure to the specific eBTC pool and prevented spillover into other lending markets.

Monad itself was not breached. The incident occurred at the protocol level within Echo’s deployment on the chain.

Operational Weaknesses Rather Than Code Errors

Echo stated that the root cause was a compromised admin key. The smart contract logic did not fail. Instead, the setup around the contract created a single point of control.

The DEFAULT_ADMIN_ROLE had authority to grant and revoke other roles, including minting rights. With that role tied to a single private key and no additional safeguards such as multi signature controls or mint caps, the system depended entirely on the security of one credential.

Once the attacker obtained that key, they could legitimately execute administrative functions within the contract’s rules. The attack sequence followed standard contract permissions rather than exploiting a vulnerability in the code itself.

The gap between the $76.7 million minted and the $816,000 actually extracted reflects liquidity constraints and collateral limits within the Monad ecosystem. According to the breakdown, Curvance’s available borrowing capacity capped the amount of WBTC that could be withdrawn against the fake collateral.

Protocol Response and Containment Measures

After the incident became public, Echo regained control of the admin key. The team burned the remaining 955 eBTC held in the attacker’s wallet and paused cross chain functionality on Monad.

Echo also pushed a contract upgrade on Monad to restrict affected operations and announced plans to patch other EVM bridge deployments. Curvance paused the eBTC market and confirmed that its broader protocol remained secure.

The price of ECHO, the project’s token, reportedly declined by approximately 11 to 12 percent following the event.

Our Assessment

The Echo Protocol incident resulted in approximately $816,000 in realized losses, despite an initial notional figure of $76.7 million in newly minted tokens. The exploit stemmed from a compromised admin key rather than a flaw in smart contract logic. Limited liquidity on Monad and isolated lending markets at Curvance constrained the financial impact. Echo has since burned the remaining unauthorized tokens and implemented contract level restrictions to address the compromised access.