Echo Protocol Suspends Monad Bridge After eBTC Exploit

Highlights:

• Echo Protocol suspended cross-chain transactions after a security incident affected its Monad bridge.
• PeckShield and Lookonchain said the attacker minted 1,000 unauthorized eBTC tokens.
• Monad CEO Keone Hon said the network stayed safe, with losses near $816,000.

Echo Protocol has suspended all cross-chain transactions after a security incident hit its bridge on Monad. The project confirmed on Tuesday that it was investigating an incident affecting the Echo bridge and said transactions would remain paused until the review is complete.

Advertisement

We are currently investigating a security incident impacting the Echo bridge on Monad. All cross-chain transactions remain suspended while the investigation is underway.

We will continue to provide timely updates through our official channels as more information becomes…

— Echo Protocol (@EchoProtocol_) May 19, 2026

The issue involved eBTC, a Bitcoin-linked token used in Echo Protocol’s system. Blockchain security firms PeckShield and Lookonchain reported that the attacker minted 1,000 eBTC without authorization. The tokens were worth about $76.7 million at the time of the incident.

#PeckShieldAlert @dcfgod reports that @EchoProtocol_ was hacked on @monad

The hacker minted 1k $eBTC ($76.7M) &, utilizing the tested flow, deposited 45 $eBTC ($3.45M) into Curvance. They then borrowed ~11.29 $WBTC ($867.7K) against it, bridged the $WBTC to #Ethereum, swapped… https://t.co/DjgI0v85Rw pic.twitter.com/wNnA77UDuI

— PeckShieldAlert (@PeckShieldAlert) May 18, 2026

The first public warning came from on-chain analyst dcfgod, who flagged unusual eBTC activity on Monad. The attacker then used part of the newly minted eBTC to borrow real Bitcoin-backed assets through Curvance, a DeFi lending protocol.

Attacker Used eBTC to Borrow WBTC

According to blockchain tracking reports, the attacker deposited 45 eBTC into Curvance. The attacker then borrowed about 11.29 wrapped Bitcoin, also known as WBTC. WBTC is a token that represents Bitcoin on other blockchain networks.

After borrowing the WBTC, the attacker bridged the funds to Ethereum and swapped them for ETH. PeckShield later tracked the movement of 384 ETH to Tornado Cash. Tornado Cash is a crypto mixing service that can make it harder to follow the movement of funds.

Although the unauthorized eBTC mint was valued at around $76.7 million, Monad CEO Keone Hon said security researchers estimated the actual stolen amount at about $816,000. He also said the issue did not affect the Monad network itself.

To clarify, the Monad network is not affected and is operating normally

Security researchers in their review have determined that ~$816,000 appears to have been stolen as a result of this exploit of @EchoProtocol_ 's eBTC

— Keone Hon (@keoneHD) May 18, 2026

Curvance Pauses Affected Market

Curvance also responded after detecting abnormal activity in the Echo eBTC market. The protocol said it paused the affected market while working with ecosystem partners to investigate the issue. Curvance added that it had found no sign of compromise in its own smart contracts.

The protocol said its isolated market design helped protect other markets from the incident. In DeFi, isolated markets separate risk between different assets. So, a problem in one market does not automatically spread to all other markets.

At approximately 6:00 PM EST, we were made aware of an anomaly detected in the Echo eBTC market on Curvance. At this time, there is no indication of any compromise with Curvance’s smart contracts.

Due to Curvance’s fully isolated market architecture, no other markets are…

— Curvance (@Curvance) May 18, 2026

Echo Protocol has not yet released a full post-mortem report. The project said it would share more information through its official channels as the investigation continues. For now, users cannot make cross-chain transactions through the affected bridge.

Private Key Issue Under Review

Early security analysis suggests the incident may have been linked to an admin private key problem. Yu Jian, founder of SlowMist, suggested that the theft may have been caused by the compromise of an admin single-point private key. A private key works like a password that controls access to crypto assets or system permissions.

Blockchain developer Marioo also described the incident as a compromised admin private key issue rather than a smart contract bug, according to reports. That means the problem may have come from access control rather than broken code in the protocol.

The incident adds fresh concern around cross-chain bridges and DeFi security. Bridges are often high-risk because they move assets between different networks. If controls around minting, admin access, or asset backing fail, attackers can quickly use fake or unsupported tokens to drain real liquidity.

Echo Protocol, Curvance, and Monad are still reviewing the incident. At the time of writing, Echo’s bridge remains suspended, Curvance’s affected eBTC market remains paused, and Monad says its network continues to operate normally.

Advertisement