On May 19, on-chain monitoring revealed that an attacker compromised an administrator key in the Echo Protocol implementation on Monad and issued 1,000 eBTC. The unauthorized tokens were valued at approximately $76.6 million at the time of mining.
Funds transferred via Curvance and Tornado Cash
After issuance, the attacker deposited 45 eBTC into Curvance, borrowed 11.29 WBTC and transferred the assets to Ethereum. A portion of the proceeds were later sent through Tornado Cash. Security firm PeckShield tracked the flow and confirmed the laundering route.
Protocol response and remaining exposure
Echo Protocol suspended cross-chain transactions after the incident. The team later claimed to have regained control of the administrator keys and burned a portion of the issued offering. However, the attacker still holds about 955 eBTC, worth about $73 million at current prices.
Exploit Alert
According to @dcfgod, @EchoProtocol_ on @monad has been exploited.
The attacker reportedly minted 1,000 $eBTC worth $76.7M…
— PeckShield (@PeckShieldAlert)
May 19, 2026
Future implications
The exploit highlights persistent risks related to administrator key management in bridge and synthetic asset deployments. With nearly $74 million in unauthorized supply yet to be accounted for in attacker wallets, additional movement of these tokens could put additional pressure on liquidity pools and affected markets.