Echo Protocol Exploit on Monad Prompts Suspension of Cross-Chain Transfers

Echo Protocol Exploit on Monad Mints 1,000 eBTC – Cross-Chain Transfers Suspended as May Hack Count Reaches 14

Key Takeaways

Echo Protocol suffered an exploit on Monad in which an attacker minted 1,000 eBTC valued at about $76.64 million.
Security researchers determined that approximately $816,000 was stolen as a result of the exploit.
Curvance paused the affected Echo eBTC market but stated its smart contracts were not compromised.
Echo Protocol suspended all cross-chain transactions while investigating the incident.
The case marks the 14th crypto hack reported in May and the third major DeFi breach within five days.

How the Echo Protocol Exploit Unfolded on Monad

On May 19, Echo Protocol confirmed a security incident affecting its eBTC bridge on the Monad network. The incident was first flagged by on-chain analyst dcfgod, while blockchain security firm PeckShield mapped the subsequent laundering path.

According to the available information, the attacker minted 1,000 eBTC, with an estimated value of approximately $76.64 million. The exploiter then deposited 45 eBTC, worth about $3.45 million, into the lending platform Curvance. From there, the attacker borrowed 11.29 wrapped Bitcoin (WBTC), bridged the assets to Ethereum, and swapped them for Ethereum (ETH).

The wallet involved in the exploit later transferred 384 ETH to Tornado Cash, a crypto mixing service. This sequence of transactions outlines the flow of funds following the initial minting of eBTC.

Echo Protocol stated on X that it is investigating a security incident impacting its bridge on Monad. As an immediate response, the project suspended all cross-chain transactions. The team said it would provide updates through official communication channels as the investigation progresses.

Monad Network and Curvance Clarify Scope of Impact

Following the incident, Monad CEO Keone Hon addressed concerns about the broader network. He stated that the breach did not impact the Monad network itself. According to security researchers reviewing the case, approximately $816,000 appears to have been stolen as a result of the exploit involving Echo Protocol’s eBTC.

Curvance, which was used by the attacker to deposit eBTC and borrow WBTC, also published a status update. The platform reported that it became aware of an anomaly in the Echo eBTC market at approximately 6:00 PM EST.

Curvance emphasized that there was no indication of any compromise to its own smart contracts. It further stated that its fully isolated market architecture prevented the issue from affecting other markets on the platform. As a precautionary measure, Curvance paused the affected Echo eBTC market while investigating the situation in coordination with ecosystem partners.

These statements clarify that, based on the information currently available, the exploit was limited to Echo Protocol’s bridge mechanism and did not extend to Monad’s core infrastructure or Curvance’s broader system.

Transaction Path and Asset Movements After the Minting

The transaction trail provides insight into how the attacker handled the minted assets. After creating 1,000 eBTC, the exploiter used a portion of the tokens to interact with Curvance. By depositing 45 eBTC as collateral, the attacker borrowed 11.29 WBTC.

The borrowed WBTC was then bridged to Ethereum and converted into ETH. A total of 384 ETH was subsequently sent to Tornado Cash. The use of a mixing service is a common step in attempts to obscure transaction history, though the investigation into this specific case remains ongoing.

While the minted amount was valued at tens of millions of dollars, Monad CEO Keone Hon cited security researchers who estimated the actual stolen amount at approximately $816,000. This distinction indicates that not all minted assets resulted in realized losses.

Third Major DeFi Breach in Five Days

The Echo Protocol exploit is the third major decentralized finance breach reported within five days. On May 15, THORChain confirmed a vault breach that resulted in losses exceeding $10 million. Three days later, security researchers identified an exploit affecting the Verus-Ethereum Bridge, where attackers drained roughly $11.58 million in digital assets.

With Echo Protocol now added to the list, the number of crypto hacks reported in May has reached 14. The clustering of incidents within a short time frame highlights ongoing operational and security challenges across DeFi protocols, particularly those involving cross-chain bridges and vault mechanisms.

For users who rely on decentralized bridges and lending markets, these incidents directly affect access to services. In this case, Echo Protocol’s suspension of cross-chain transactions temporarily limits transfers across supported networks, while Curvance’s pause of the Echo eBTC market restricts activity in that specific segment.

Operational Consequences for Users

Echo Protocol has halted all cross-chain transactions pending further investigation. This means users cannot currently move assets through the affected bridge on Monad. The duration of the suspension has not been specified.

Curvance’s decision to pause only the impacted Echo eBTC market, while leaving other markets unaffected, reflects its isolated market structure. According to the platform, this design prevented broader contagion within its system.

For users interacting with DeFi platforms, such measures can result in temporary liquidity constraints or delays in asset transfers. However, both Echo Protocol and Curvance have indicated that investigations are ongoing and that further updates will be communicated through official channels.

Our Assessment

The Echo Protocol exploit involved the minting of 1,000 eBTC on Monad and led to an estimated $816,000 in stolen assets, according to security researchers cited by Monad’s CEO. Echo Protocol suspended cross-chain transactions, and Curvance paused the affected market while stating its own contracts were not compromised. The incident is part of a series of three major DeFi breaches within five days and brings May’s total reported crypto hacks to 14, underscoring continued security risks in cross-chain and DeFi infrastructure.