Echo Protocol confirmed that a leaked admin key allowed an attacker to mint eBTC tokens without authorization on the Monad network, resulting in approximately $816,000 in losses. The team says it has since regained control of the compromised key and burned the remaining 955 eBTC still held by the attacker, effectively neutralizing that portion of the exploit.
The incident appears contained to Monad for now. Echo estimates Aptos-side exposure at roughly $71,000, with no evidence of a broader compromise on that chain. As a precaution, the team has paused Monad bridge functions and upgraded the relevant contracts.
Users are being warned to stay alert: phishing links posing as refund, claim, and recovery portals are already circulating. Echo has not yet published a full post-mortem or compensation timeline, leaving affected users waiting for clarity on restitution.