Back En.Bloomingbit

Echo Protocol Hack May Have Stemmed From Stolen Admin Key, Not Smart Contract Flaw

En.Bloomingbit • May 19, 2026

The hack of Monad-based decentralized finance project Echo Protocol may have been caused by a stolen administrator private key rather than a smart contract flaw.

Cointelegraph reported on May 19 that blockchain developer Marioo described the incident as a compromised admin private key, not a smart contract bug. In his analysis, the breach was closer to an operational failure than a technical defect.

Blockchain security firms PeckShield and Lookonchain had earlier reported that the attacker minted 1,000 eBTC on Echo Protocol without authorization. The losses are estimated at $76.7 million.

Marioo said the eBTC contract itself functioned as designed. He cited a single-admin signature structure, the absence of a timelock, no minting cap and insufficient vetting of new collateral as factors behind the incident.

The hacker deposited 45 eBTC as collateral on Curvance, a DeFi liquidity and lending protocol, and borrowed 11.3 WBTC. The assets were then bridged to the Ethereum network and exchanged for ETH. 384 ETH was later moved to Tornado Cash.

According to DeBank, the attacker still holds 955 eBTC, worth roughly $73 million.

Echo Protocol said it is investigating the security incident tied to its Monad-based bridge and has halted all cross-chain transactions. Curvance also temporarily suspended the related market after detecting unusual activity, but said there were no signs its own smart contracts had been compromised.

Keone Hon, Monad's co-founder, said the network itself was unaffected and continues to operate normally.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Echo Protocol Exploit Results in $76M Loss Due to Compromised Admin Key On May 19, 2026, Echo Protocol, a Bitcoin DeFi platform, suffered a significant exploit on the Monad blockchain, leading to the unauthorized minting of 1,000 eBTC valued at approximately $76 million. The breach was attributed to a compromised admin key, allowing the attacker to mint and subsequently launder around $816,000 through Tornado Cash. The hacker deposited 45 eBTC worth $3.45 million into the lending platform Curvance, borrowed 11.29 WBTC, and converted it to ETH. Echo Protocol confirmed that the Monad network itself was not compromised, and they have regained control of the admin keys and burnt the remaining eBTC held by the attacker. The incident has prompted Echo Protocol to suspend all cross-chain transactions and enhance security measures. The attack reflects ongoing vulnerabilities in DeFi protocols, particularly concerning centralized key management. 12 sources 68

Extracted Entities

Echo Protocol Hack May Have Stemmed From Stolen Admin Key, Not Smart Contract Flaw

The full story

Extracted Entities

Attack Types (1)

Companies (2)

Tools (1)