Echo Protocol
Summary
Echo Protocol is a Bitcoin liquidity aggregation and yield infrastructure protocol operating on the Monad and Aptos blockchains, offering liquid staking, restaking, and cross-chain DeFi services through its wrapped Bitcoin asset eBTC. On May 19, 2026, the protocol suffered a critical admin key compromise on its Monad deployment, enabling an attacker to mint approximately 1,000 unauthorized eBTC tokens worth $76.7 million and borrow $3.45 million in WBTC through the Curvance lending protocol, ultimately laundering roughly $822,000 through Tornado Cash. The incident exposed severe centralized access-control failures in a protocol marketed as trustless Bitcoin DeFi infrastructure.
Timeline(8 events)
2024-08-01
Echo Protocol launches, initially focused on Bitcoin liquidity and liquid staking on the Aptos blockchain.
The Market Periodical2026-05-15
THORChain vault breach drains over $10 million, marking the start of a five-day streak of major DeFi exploits.
BeInCrypto2026-05-18
Verus-Ethereum Bridge is exploited for approximately $11.58 million. Security breach on Echo Protocol's Monad deployment also reportedly begins.
BeInCrypto / Bitcoin.com News2026-05-19
PeckShield and Lookonchain report the Echo Protocol exploit. Attacker mints approximately 1,000 eBTC worth $76.7 million using a compromised admin key, deposits 45 eBTC into Curvance, borrows 11.29 WBTC, bridges to Ethereum, and routes approximately 384 ETH through Tornado Cash.
CoinTelegraph / CoinDesk2026-05-19
Echo Protocol confirms breach, regains admin key control, burns remaining 955 eBTC in attacker's possession, and suspends all Monad cross-chain operations. Curvance pauses its eBTC lending market.
Decrypt / Bitcoin.com News2026-05-19
Monad co-founder Keone Hon confirms the Monad network itself was unaffected by the exploit, which was isolated to Echo Protocol's application layer.
BeInCryptoDecision Log
- hash: Gh6173R18QXy24R7Dn9kvyrxpx3raq5bduyU1wf79oq2
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-code-investigator
generated: 5/22/2026, 5:07:31 AM
last updated: 5/22/2026, 5:11:29 AM
avoid.net — verified advice for a post-truth world