Echo Protocol was hacked by a $77 million eBTC mint exploit on Monad

Echo Protocol, a platform for pooling Bitcoin liquidity and returns, saw a sudden 12% sell-off before US market hours on Wednesday to trade at $0.0049. The primary catalyst behind this decline is A Major security breach on an eBTC deployment for the Monad blockchain, where the attacker used a compromised administrator key to create 1,000 eBTC tokens. The team immediately halted cross-chain operations linked to the Monad to contain the damage, and began a full audit of the incident and necessary bridge upgrades.

Echo Protocol suffers an administrator key breach when deploying a Monad

Another security incident occurred with the publication of eBTC on the Monad blockchain, where unauthorized tokens were minted, and approximately $816,000 was withdrawn. The incident, which came to light on May 19, 2026, resulted from a compromised administrator key and not a flaw in the underlying smart contracts or the Monad network itself.

Attack execution and money flows

According to Data on the stringhackers took control of administrative rights and created about 1,000 eBTC tokens. At current prices, it is estimated to be worth $76-77 million. The exploiter deposited a portion – around 45 eBTC – into the Curvance lending platform as collateral. From there, they withdrew WBTC, exchanged those tokens for ETH, and sent approximately 384-385 ETH through Tornado Cash to hide the transaction path.

BixshieldIt, among other security companies, monitored the activity and estimated the actual loss at $816,000. After initial actions, the attacker remained in control of approximately 955 eBTC. Later, Echo Protocol confirmed that it had regained access to the administrator’s keys, and removed all remaining tokens held by the adversary.

The Monad network operates without interruption. Co-founder Keone Hon publicly stated that the blockchain infrastructure was not affected during the event and was operating as usual.

Response and containment measures

The Echo Protocol responded quickly upon detection. The team has halted cross-chain operations associated with the Monad deployment and upgraded relevant contracts to enhance control over sensitive functions and prevent any unauthorized activities. The bridge function across other deployments received additional scrutiny.

As a general precaution, although no evidence of tampering was found at the Aptos Bridge, the operators ceased their activities there completely. Echo believes that aBTC on Aptos and eBTC on Monad are non-interoperable assets. Lending Markets and Liquidity Pools exposure to Aptos was limited to approximately $71,000 in total exposure, with no confirmed losses at the time of the announcement.

The protocol also urged users to stay away from any unofficial websites, refund claims, or refund pages, emphasizing that only official channels will be used for official communications. The team will not make any requests for private keys or direct transfers.

Echo Protocol becomes third major breach in four days

The Echo Protocol incident comes on the heels of other notable violations. On May 15, THORChain has been exploited for an estimated $10.8 million across four chains: Bitcoin, Ethereum, BSC, and Base, resulting in a temporary halt to trading and signing. The last Verus-Ethereum drain event was worth around $11.5 million, on May 18. The third major event in just four days is Echo.

The pace is similar to other times this year. Massive losses of more than $600 million occurred during April 2026, due to a security vulnerability in the liquid restocking project. Kilbdaw Through the LayerZero bridge attack and social engineering attack on the Drift Protocol decentralized perpetual exchange that resulted in a loss of $285 million. Losses in the DeFi sector rose rapidly in early 2026, and bridge-related hacks continue to be a recurring vulnerability.

These recurring incidents underscore the ongoing challenges related to token key management, cross-chain messaging, and operational security in DeFi. Even after audits, single points of failure such as (non-multiple) administrative controls with no time locks or minting limits still exist in the protocols.

A full security audit and bridge upgrades are currently underway

Echo Protocol noted that it is conducting a full audit of Monad’s deployment, bridge infrastructure, permission structures, mining logic, and operational security practices. External security coordination and engagement with ecosystem partners is underway to verify the extent of the incident and put in place robust protection measures. Additional upgrades to EVM Series bridge deployments are currently being made to strengthen defenses across the chain as well.

The leak appears to be limited to the Monad deployment for now. There has been no evidence of a broader compromise on which other chains the Echo supports. The market responded with a downward trend on ECHO and related tokens.

Key support levels to watch as ECHO price reaches a new low

Since last week, the price of Echo Protocol coin has dropped from $0.0072 to the current trading value of $0.0049, registering a loss of 32%. As a result, the market capitalization of the asset fell to $1.56 million and the 24-hour trading volume increased by 20% to $116.96 thousand, indicating strong selling pressure.

Amid this decline, the coin’s price fell decisively below the February 2026 low of $0.0055. Since today’s crash was primarily driven by sentiment related to the breakout, ECHO’s price is likely to see notable volatility in the coming days.

The price is likely to rebound from the immediate support of $0.00485 and retest the breached $0.0055 level as a potential resistance to check its sustainability for the next move. If sellers hold this resistance, ECHO price could fall another 34% to $0.0032.

Conversely, if the coin price can recover the lower limit of $0.0055, buyers may attempt the initial recovery phase to $0.0077.