A Bitcoin-focused decentralized finance platform has halted its cross-chain operations after an attacker generated roughly 1,000 unauthorized synthetic Bitcoin tokens, valued at approximately $76.7 million, on its Monad deployment. The exploit was detected by blockchain security firm PeckShield and on-chain analytics service Lookonchain, who reported the incident on Tuesday.
Early analyses from multiple researchers indicate that the breach did not stem from a vulnerability in the Monad network itself. Instead, the attack appears to have been facilitated by compromised administrative access tied to Echo Protocol’s infrastructure. Shortly after the unauthorized minting, the exploiter moved part of the fraudulent tokens into decentralized lending markets. According to Onchain Lens, 45 eBTC were deposited as collateral into the lending protocol Curvance, allowing the attacker to borrow approximately 11.29 wrapped Bitcoin, worth nearly $868,000 at the time.
After securing the borrowed assets, the attacker bridged the WBTC to Ethereum, swapped the tokens into ETH, and later routed 385 ETH through the crypto mixing service Tornado Cash, according on-chain investigators. PeckShield separately estimated that 384 ETH, valued around $822,000, had already been transferred to the mixer. Most of the unauthorized supply remains untouched. Lookonchain and DeBank data show the attacker still controls about 955 eBTC, valued at over $73 million. DefiPrime founder Nick Sawinyh noted that the remaining tokens appear stranded because Monad’s current lending and decentralized exchange liquidity cannot absorb an exit of that size.
Sawinyh warned that for anyone using newly launched lending markets on new chains, the key takeaway is to verify what collateral can be minted and who holds the authority to mint it. He emphasized that if a lender cannot disclose which keys can produce that collateral, it represents a significant risk.
While Echo Protocol initially confirmed only that it was investigating a security incident impacting its bridge on Monad, blockchain developer Marioo later stated that the issue stemmed from an admin private key compromise rather than a smart contract failure. According to Marioo, the eBTC contract functioned as intended, but several operational weaknesses allowed the attack to escalate. These included a single-signature admin role, the absence of a timelock mechanism, no minting cap or issuance rate limit, and a lack of collateral verification checks on Curvance for newly minted eBTC.
Curvance acknowledged the incident shortly afterward and confirmed that the affected Echo eBTC market had been paused as a precaution. The protocol added that its isolated market structure prevented the issue from spreading to other lending pools and stated there was no indication that Curvance’s own smart contracts had been compromised. On the network side, Monad co-founder Keone Hon said the blockchain itself continued operating normally and had not been breached. In a later update, Hon stated that security researchers estimated around $816,000 in actual value had been extracted through the exploit despite the much larger unauthorized mint.
Echo Protocol, which operates as a Bitcoin liquidity and yield platform across multiple chains including Aptos and Monad, said cross-chain transactions had been suspended while the investigation continues. The team added that future updates would be shared through its official channels. This incident adds to a growing list of DeFi security events this month alone, including a recent $11.6 million exploit involving Verus Protocol’s Ethereum bridge. Earlier this year, Drift Protocol lost roughly $285 million in an exploit, while Kelp DAO suffered a separate attack resulting in losses of about $292 million. More recently, THORChain halted trading after blockchain investigator ZachXBT flagged a suspected $10 million exploit, and Transit Finance disclosed a deprecated smart contract attack that led to losses of nearly $1.88 million.