Echo Protocol Exploit and THORChain Halt Test DeFi Resilience in Mid-May 2026
Echo Protocol on the Monad chain lost roughly $76.7 million after an attacker minted 1,000 unauthorized eBTC tokens through an admin key compromise.
Summary
- Echo Protocol on the Monad chain lost roughly $76.7 million after an attacker minted 1,000 unauthorized eBTC tokens through an admin key compromise.
- THORChain executed emergency halts across multiple chains on May 15 following a suspected exploit that drained between $10.7 million and $11 million.
- Both incidents occurred within days of each other and reinforce ongoing calls for stronger administrative controls in DeFi protocols.
An attacker drained $76.7 million from Echo Protocol. They minted 1,000 fake eBTC tokens on the Monad chain and walked away with the funds. Reports from blockchain trackers confirm the admin key breach.
Monad kept running without a hitch. The one-two punch of this hit and the THORChain event has analysts talking again about weak spots in DeFi security. Both strikes landed in the same week.
Context
DeFi keeps taking hits aimed at admin keys and bridges. Echo Protocol runs a Bitcoin liquidity setup on Monad. THORChain handles liquidity across many separate networks.
These moves fit the 2026 pattern of key thefts and sudden halts. Probes are still open. Loss numbers could change once teams finish digging.
Details
The attacker grabbed an admin key on Echo Protocol. They minted the bogus eBTC right on Monad and the team froze cross-chain moves to stop more outflows. Monad itself suffered no damage and kept producing blocks.
THORChain pulled the plug on trading and withdrawals across at least four chains on May 15. Early counts put the take at $10.7 million to $11 million. Reviews are still wrapping up.
"The exploit was confirmed to be limited to Echo Protocol's eBTC, which operates on the Monad chain."
, Investigation report (xangle.io)
Both teams moved fast once alerts fired. Echo shut the bridge and THORChain fired its emergency stop.
Reaction
Prices held steady across the market. Traders still pulled liquidity from the exposed pools within hours. Researchers called the pair of events a fresh warning sign.
Outlook
Forensic crews at both projects keep combing through logs. Everyone waits to see if Echo and THORChain release full post-mortems and add tougher multi-sig or hardware rules soon.
