Bitcoin-focused DeFi protocol Echo suffered an exploit on Monday, marking the latest in a wave of DeFi attacks this year. The root cause of the exploit has yet to be identified.
The exploit was first flagged by pseudonymous crypto influencer DCF GOD on X at around 5:55 p.m. on Monday, ET. Other onchain analytics accounts on the social media platform have relayed the findings with additional details.
According to Onchain Lens, the attacker minted 1,000 eBTC — Echo Protocol's bitcoin liquidity token issued on Monad — and deposited 45 eBTC to DeFi lending protocol Curvance as collateral to borrow around 11.29 WBTC, worth roughly $867,700 at the time.
The exploiter then bridged the WBTC to Ethereum and swapped the tokens into ETH (ETH). The 385 ETH was moved to the crypto mixer Tornado Cash.
The attacker still holds 955 eBTC, worth $73,2 million, according to Lookonchain. "The other 99% of the fake supply is parked on the attacker's wallet, because Monad's lending and DEX depth can't absorb more," DefiPrime Founder Nick Sawinyh wrote in a post.
Monad and Curvance have since acknowledged the exploit. Monad Co-founder Keone Hon said its security researchers are currently investigating the incident, while assuring that the network itself is not affected.
"Security researchers in their review have determined that ~$816,000 appears to have been stolen as a result of this exploit of [Echo Protocol's] eBTC," Hon added in a follow-up post.
Meanwhile, Curvance wrote that its fully isolated market architecture has shielded other markets from being affected, and that there is no indication of any compromise with its smart contracts. Curvance said that it paused the affected Echo eBTC market out of caution.
Echo Protocol is a multi-chain BTCFi protocol that launched as a bitcoin liquidity and yield platform with a large presence on Aptos.
Before the Echo exploit, there had already been 13 security breaches on DeFi protocols this month, according to DefiLlama, including the $11.6 million exploit on Verus' Ethereum bridge that occurred on May 17.
This is a developing story.
