eBTC vs WBTC vs cbBTC and What Each Tokenized Bitcoin Actually Backs

On May 19, 2026, Echo Protocol's eBTC contract on Monad minted roughly $76.6 million of tokens with no underlying Bitcoin behind them, after an admin key tied to the bridge was compromised and the attacker simply called the mint function. Less than 48 hours later, both WBTC and cbBTC were still publishing the same one-to-one reserve attestations they had been publishing all month, with no incident on either side. That gap is the entire point of this comparison.

All three tokens claim to be "Bitcoin on another chain," but only two survived the week without a hole on the balance sheet. The reason has nothing to do with how the token looks on a block explorer and everything to do with who holds the underlying BTC and what it takes to mint a new unit.

The Problem Every Tokenized Bitcoin Is Trying to Solve

Bitcoin's base layer is good at one thing. It moves and stores BTC. It does not run lending markets, it does not host orderbooks, and it does not natively talk to Ethereum, Solana, Monad or any other smart contract chain. That is a design choice, not a flaw, but it is also why more than $30 billion of BTC currently lives on other chains as a tokenized representation.

The trade is straightforward. A user gives up custody of real BTC, and in exchange they get a token on a faster, programmable chain that they can use as collateral or trade against other assets. The hard part is the middle step, where someone has to actually hold the Bitcoin and prove the outstanding supply matches it.

That "someone" is where eBTC, WBTC and cbBTC diverge completely.

• WBTC is custodied by an institutional Bitcoin custodian and minted by approved merchant partners.

• cbBTC is custodied by a US-regulated exchange that publishes the reserves on its own balance sheet.

• eBTC, until this week, was minted by a protocol-controlled bridge whose admin keys turned out to be a single point of failure.

Three different trust models with three different attack surfaces, and as Monad just demonstrated, three very different outcomes when something goes wrong.

WBTC Explained and Why It Is Still the Liquidity Anchor

WBTC launched in January 2019 and is still the largest tokenized BTC by a wide margin, with roughly 128,000 BTC backing the supply across Ethereum, Tron and a handful of other chains. The original structure was simple. BitGo custodied the Bitcoin in cold storage, a DAO of merchants and members controlled mint and burn, and proof-of-reserve attestations were published continuously.

The structure got more complicated in 2024 when BitGo announced a multi-jurisdiction custody arrangement involving BiT Global, with key shards split across BitGo and partners in Singapore and Hong Kong. That change is the main reason MakerDAO briefly removed WBTC as collateral and several other lending protocols cut exposure. Most have since restored WBTC, but the episode is a useful reminder that the "who holds the Bitcoin" question is not static.

What still works for WBTC. The reserves are real, the attestations are independent, and the address holding the BTC is public. You can verify the WBTC supply against the BitGo-controlled cold storage address yourself.

What does not hold up as well is the structural fragility. WBTC is a federated trust model. If the custodian goes down, gets sanctioned, or quietly changes its key-management structure again, every WBTC token outstanding inherits that risk. There is no on-chain enforcement that the BTC must be there. There is only an attestation saying it is.

WBTC trades primarily on Ethereum DeFi as collateral on Aave, Compound and MakerDAO, as the BTC leg in Uniswap and Curve pools, and as the underlying for Bitcoin perps on a few perpetual DEXs. For the BTC-USDT leg most traders actually care about, the deep book still lives on centralized venues like Phemex futures rather than on the wrapped token itself.

cbBTC Explained and the Coinbase Custody Model

cbBTC is the newer entrant. It launched in September 2024 on Base, then expanded to Ethereum and Solana, and is issued and custodied entirely by Coinbase. The token is one-to-one backed by BTC that Coinbase holds in its own institutional custody platform. The supply has grown to roughly 47,000 BTC by mid-May 2026 according to CoinGecko.

The trust model is the opposite of WBTC's. Where WBTC distributes custody across a federation, cbBTC concentrates it in a single US-regulated public company with no merchant DAO, no key-sharding agreement, and no separate proof-of-reserve attestor. Coinbase mints cbBTC when a user deposits BTC, redeems it on withdrawal, and publishes the holdings as part of its standard reserve reporting.

That has two real consequences. First, the audit surface is regulatory rather than cryptographic, so cbBTC holders are trusting Coinbase's filings, public-company accounting and the US framework that backs them. Second, the BTC sits inside a single legal entity, which means a regulator action or any operational failure at the custodian hits all of cbBTC at once. The trade is concentration risk in exchange for institutional clarity.

In DeFi terms, cbBTC is where Base-native BTC liquidity now lives, with Aerodrome and Aave on Base both using it heavily. On Solana it competes with Threshold's tBTC and a few smaller wraps, and on Ethereum it has eaten into WBTC's lead in raw new supply over the last six months even if WBTC still holds the larger float.

eBTC Explained and the Monad Hack Lesson

Echo Protocol is a Bitcoin DeFi protocol that launched on Monad earlier in 2026. eBTC was its native wrapped Bitcoin, minted when users deposited BTC through a bridge controlled by the protocol itself. There was no third-party custodian. The protocol's smart contracts and admin keys were the entire trust model.

On May 19, that model failed. According to early on-chain analysis from PeckShield and post-incident reporting on The Block, an attacker gained control of an admin address tied to the eBTC minting contract and minted approximately $76.6 million of eBTC with no corresponding BTC deposits. The unbacked supply was then sold into eBTC liquidity pools on Monad, draining real value out of the protocol's pools and crashing the eBTC price against its peg. Echo paused contracts within hours, but by then the damage was done.

The lesson is not "DeFi is broken." The lesson is that "protocol-minted" BTC is a categorically different asset from custodian-minted BTC, even when both tokens carry BTC in the name. To break WBTC or cbBTC, an attacker has to compromise a regulated custodian sitting on cold storage. To break eBTC, an attacker only had to compromise a hot admin key on a chain less than a year old. The cost of attack was orders of magnitude lower, the consequence was the same as if a central bank printed money against no reserves, and the peg broke immediately.

This is also why exchanges have been slow to list protocol-minted BTC tokens for spot trading. The attack surface is too wide and changes too often, and the price oracle problem becomes immediate the moment a peg breaks.

For context, the broader tokenized BTC market includes Threshold's tBTC using a randomized signer set, Binance's BTCB on BNB Chain, Ignition FBTC and Lombard's LBTC. Each one sits somewhere on the same axis between institutional custody at one end and a smart contract bridge at the other, and eBTC sat firmly on the bridge end.

Side By Side and What Actually Matters for Holders

The differences look subtle in marketing copy and large in practice. The table strips them down.

Two takeaways for holders. First, "Bitcoin on another chain" is not a single asset class. The risk profile of WBTC and cbBTC is closer to a custodian default risk. The risk profile of eBTC is closer to a smart contract risk on a new L1. Treat them differently for sizing, especially as collateral.

Second, the only way to actually price these tokens is to read the proof. For WBTC, that is the public BitGo address and the latest attestation. For cbBTC, that is Coinbase's reserve reporting. For protocol-minted BTC tokens, that is the on-chain mint function, the controlling keys, and the audit history of the bridge. If a project will not publish those, the token is not Bitcoin on another chain. It is just an unsecured IOU with a BTC label on it.

Frequently Asked Questions

Is cbBTC safer than WBTC?

Not strictly safer in an absolute sense, just differently exposed to a different set of risks. cbBTC concentrates the risk in one US-regulated entity with clear reporting requirements, while WBTC spreads it across a federated custody arrangement and a merchant DAO. If you trust the US regulatory framework around a public custodian, cbBTC removes most of the multi-jurisdiction complexity. If you prefer not to depend on a single corporate entity, WBTC's distributed model is the trade-off.

Could a hack like the Echo Protocol incident happen to WBTC or cbBTC?

It would require compromising a regulated cold-storage custodian rather than a hot admin key on a new chain. That is a fundamentally harder operation, and there is no precedent for it on either WBTC or cbBTC since launch. The Echo attack worked because the minting authority sat in a hot contract with admin privileges. WBTC and cbBTC mint flows route through institutional custody operations with multi-party approvals.

Are eBTC tokens still worth anything after May 19?

eBTC currently trades well below its peg on Monad-native venues, reflecting the unbacked supply that was minted and dumped. Recovery depends entirely on Echo Protocol's ability to identify the stolen funds, return assets, and restructure the contract under new key controls. Anyone holding eBTC at this point is holding a claim on that recovery process, not on Bitcoin.

Which tokenized Bitcoin do most DeFi protocols actually use?

WBTC still dominates total locked value across Ethereum mainnet DeFi, but cbBTC has been gaining share quickly on Base and Solana, and on Ethereum among newer protocols. tBTC is the preferred option for protocols that want a more decentralized custody model. Protocol-minted wrappers like eBTC are mostly used inside their own ecosystems and rarely show up as collateral on major lending markets, which is exactly why this kind of incident does not bleed into the larger DeFi system.

Bottom Line

The Echo Protocol hack is a clean illustration of a rule the market keeps relearning. The token in your wallet is only as good as the entity holding the underlying asset and the process required to mint a new unit. WBTC and cbBTC made a custody trade-off that is boring on a good day and load-bearing on a bad one. eBTC made the opposite trade-off, optimized for speed and composability on a new chain, and paid the cost the first time an admin key was exposed. Anyone using tokenized BTC as collateral going forward should look at where the Bitcoin sits, who can mint more of it, and what proof exists that the float matches the reserve. If those three answers are not public and verifiable, the token should be sized like a venture position, not like Bitcoin.

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency trading involves substantial risk. Always conduct your own research before making trading decisions.