Bitcoin DeFi app Echo Protocol said a compromised admin key let an attacker mint fake eBTC on Monad, causing about $816,000 in losses.
Bitcoin-based DeFi platform Echo Protocol, which offers wrapped Bitcoin tokens on different chains, said unauthorized minting occurred on its deployment on Monad, a blockchain Layer-1 platform, due to compromised admin keys.
In a May 19 thread on X, Echo said Monad itself wasn’t compromised, adding that the issue came from Echo’s own Monad deployment, meaning the affected contracts and permissions around its eBTC token on Monad.
Analysts from blockchain analytics firm Lookonchain said in another X post the attacker minted 1,000 eBTC, worth about $76.6 million, but Echo said it later regained control of admin keys and burned the remaining 955 eBTC held by the attacker.
Based on the transaction data and the statement made by Echo, the actual loss was estimated to be roughly $816,000.
The analysts say the hacker deposited 45 eBTC, borrowed 11.3 WBTC, bridged that WBTC to Ethereum, swapped it for 385 ETH▼$1,616.66, worth about $821,000, and then sent the ETH to Tornado Cash, a cryptocurrency mixer.
Read also: BTC Price Drops Below $77K: What Is Happening With Bitcoin and Crypto on May 18?
Bridges Paused After Fake Mint
Echo said the incident appears isolated to Monad and that it found no evidence of compromise on Aptos, another Layer-1 blockchain.
Nonetheless, the team suspended cross-chain functionalities for its Monad deployment and upgraded the respective Monad smart contracts to prevent such actions. Additionally, it also suspended Aptos bridge operations until further notice. The protocol wrote:
“We understand the concern surrounding this incident and want to be transparent about what we know at this stage. We will continue sharing updates as the investigation progresses.”
Echo said current Aptos exposure is limited to about $71,000 across Echo lending markets and Hyperion liquidity pools, with no confirmed fund loss on Aptos so far.
Founded in 2024, Echo Protocol raised a pre-seed round in October 2024, with backers listed by CoinCarp including The Spartan Group, ABCDE Capital, Maelstrom, Aptos and Movement Labs, among others.
Read more: QCP Capital Names the Condition for Bitcoin to Break Out of Its Range
