Overview
- Echo Protocol halted cross‑chain activity on Monad Tuesday after an attacker minted about 1,000 unauthorized eBTC worth roughly $76.7 million.
- The exploiter used about 45 eBTC as collateral on Curvance to borrow 11.29 wBTC, bridged the funds to Ethereum, swapped to ETH, and sent about 384–385 ETH through Tornado Cash.
- Monad’s team and Curvance said their core systems were not breached, and Echo said it is investigating the incident and has paused the affected functionality.
- Researchers point to a stolen admin key and weak safeguards that enabled the mint, including single‑signature control, no timelock, no mint caps, and lax checks on newly minted collateral.
- Security teams estimate only about $816,000 was actually cashed out, with roughly 955 eBTC left on‑chain and hard to sell on Monad’s thin markets, a dynamic drawing fresh scrutiny to bridge and lending designs in 2026.