Echo Protocol exploit on Monad mints unbacked eBTC, extracts funds

A decentralized finance protocol built on the Monad blockchain suffered a major exploit on Monday, May 19, 2026, after an attacker minted approximately 76.7 million worth of unauthorized synthetic Bitcoin tokens. The incident, which involved the Echo Protocol platform, resulted in the creation of 1,000 unbacked eBTC tokens and the extraction of real assets through a connected lending market.

Security researchers investigating the event identified a compromised administrative private key as the root cause. The attacker used this access to grant themselves minting authority and generate the synthetic tokens. The eBTC contract itself functioned as intended, but operational weaknesses, including a single-signature admin role without a timelock mechanism or minting cap, allowed the exploit to proceed.

The attacker then moved quickly to extract value. According to on-chain data, 45 of the newly minted eBTC tokens, worth about 3.45 million, were deposited as collateral into the lending protocol Curvance. This allowed the exploiter to borrow roughly 11.29 wrapped Bitcoin, valued at approximately $867,000 at the time. The borrowed assets were bridged to the Ethereum network, swapped for...