Echo Protocol, a Bitcoin-focused DeFi platform, suffered a major exploit on Monday. The attacker minted 1,000 eBTC without authorization and deposited part of the supply into Curvance as collateral to borrow wrapped bitcoin liquidity.
According to Onchain Lens, the exploiter supplied 45 eBTC to Curvance and borrowed roughly 11.29 Wrapped Bitcoin (WBTC), valued at around $867,700 at the time. The funds were then moved from Monad to Ethereum, where the attacker swapped the bitcoin-backed assets for Ether and transferred about 385 ETH into Tornado Cash.
Curvance Pauses Market, Monad Confirms No Direct Damage
Curvance quickly paused the affected Echo eBTC market while keeping other isolated lending markets operational. The protocol stated that investigators found no compromise in its core smart contract infrastructure. Monad co-founder Keone Hon confirmed that security researchers immediately began reviewing the exploit, adding that the Monad network itself suffered no direct damage — preliminary estimates put the attacker's haul at about $816,000 in liquidity.
$73 Million in Fake eBTC Largely Untouched
Blockchain analytics platform Lookonchain reported that the exploiter still controls 955 eBTC worth approximately $73.2 million. DefiPrime founder Nick Sawinyh explained that most of the unauthorized supply remains untouched because Monad’s DeFi liquidity is too shallow for large exits. Aggressive selling could overwhelm liquidity pools on smaller decentralized exchanges connected to the ecosystem. Market participants are watching the dormant wallet closely — any liquidation attempt involving the remaining fake eBTC could put additional pressure on small DeFi ecosystems with limited liquidity depth.
DeFi Security Concerns Intensify
The Echo exploit adds to a growing list of decentralized finance security incidents recorded this month. Data from DefiLlama shows that DeFi platforms have already suffered at least 13 separate exploits during May. One of the largest was the Verus Ethereum bridge, which lost nearly $11.6 million on May 17. Concerns surrounding collateral verification systems and cross-chain liquidity infrastructure continue to mount across the DeFi sector.