🚨 A $76M exploit on Monad?

The Echo Protocol incident is another example of how weak admin key security can turn into a massive headline — even when the real losses are much smaller.

🧩 What happened?

Echo Protocol — a BTCFi liquidity and yield protocol — suffered a compromised admin key on its Monad deployment.

The attacker:
• obtained DEFAULT_ADMIN_ROLE
• granted themselves MINTER_ROLE
• minted 1000 eBTC out of thin air (~$76–77M at BTC price)

But here’s the important part👇

⚠️ The attacker did NOT steal $76M.

Most of the minted eBTC had no real liquidity behind it.

Instead, the exploiter used only ~45 eBTC as collateral on Curvance to borrow around 11.3 WBTC (~$816K–867K), then bridged the funds to Ethereum, swapped to ETH, and moved assets through Tornado Cash.

💡 This was a classic “mint-and-borrow” exploit:
phantom collateral → real borrow → cash out liquidity.

The remaining 955 eBTC became effectively unusable due to thin liquidity on Monad.

🔍 Root cause:
Echo used a single EOA admin wallet without:
• multisig
• timelock
• execution delays
• additional permission controls

Once the private key was compromised, the attacker gained full protocol-level access.

📌 After the exploit:
• Echo regained admin control
• 955 eBTC were burned
• cross-chain operations on Monad were paused
• contracts were updated with stricter mint restrictions

According to Echo and Monad co-founder Keone Hon:
• Monad itself was NOT compromised
• Aptos deployment remained mostly unaffected
• Real protocol exposure was limited to ~$816K

📉 Impact:
• ECHO token dropped ~11–12%
• Curvance paused the eBTC market on Monad
• ~$816K bad debt remains unresolved
• stolen funds were already laundered, making recovery unlikely

The incident once again highlights a major issue in DeFi:
protocol security is often only as strong as the admin wallet behind it.

Website | Alerts | Chat | Twitter | YouTube