Autheo’s THEO token has plunged more than 90% following a suspected cross-chain bridge exploit that reportedly allowed an attacker to mint millions of unauthorized tokens on Base.
Summary
- Autheo has launched an investigation into a suspected THEO exploit after the token lost more than 90% of its value.
- PeckShield reported that an attacker minted 19 million THEO on Base and swapped the tokens for 700.8 ETH worth approximately $1.76 million.
- Another researcher claimed the attacker minted 119 million THEO through a suspected Hyperlane bridge vulnerability, although Autheo has not confirmed the figure.
- A wallet holder reported receiving 93.5 million THEO from the alleged attacker and offered to return the tokens to Autheo.
- Autheo has advised holders against buying, selling, or bridging THEO until its investigation is complete.
In an October 13 security notice, Autheo confirmed that its development team was investigating an incident involving THEO and warned holders against buying, selling, or bridging the token until further notice.
The project did not disclose the full extent of the breach, identify the vulnerability, or provide an estimate of financial losses.
However, blockchain security firm PeckShield reported that 19 million THEO tokens had been minted on Base before the attacker exchanged them for 700.8 ETH, worth approximately $1.76 million, and transferred the proceeds to Ethereum.
The security firm said THEO had fallen 92% over 24 hours following the incident.
THEO exploit reportedly involved unauthorized token minting
Initial reports from blockchain researchers pointed to a possible vulnerability involving the Hyperlane cross-chain bridge infrastructure.
According to an account operated by crypto researcher Vlad, the attacker minted approximately 119 million THEO tokens without authorization, an amount the researcher described as equivalent to roughly 70% of the token’s supply.
The researcher claimed the attacker subsequently sold tokens into available liquidity pools, contributing to the collapse in THEO’s market price.
PeckShield separately identified a transaction involving 19 million newly minted THEO tokens on Base. Its findings showed that the tokens were exchanged for ETH before the proceeds were bridged to Ethereum.
The 19 million tokens identified by PeckShield represent a smaller amount than the 119 million cited by Vlad. Neither figure has been confirmed by Autheo, and the available statements do not establish whether the transactions were part of the same sequence.
The project has not confirmed that Hyperlane was the source of the vulnerability or explained how unauthorized minting became possible.
Meanwhile, the reported sales left THEO trading considerably below its previous price, with PeckShield’s market data showing a decline of approximately 92% within a day.
The amount of tokens reportedly created should not be treated as the financial loss from the exploit. The value an attacker can obtain from unauthorized tokens depends on the liquidity available to exchange them for other assets.
Hacker reportedly sent 93.5 million THEO to an unrelated wallet
An unusual transfer involving 93.5 million THEO tokens emerged as researchers examined transactions linked to the suspected attack.
A verified X user operating under the name Zynex claimed that an address associated with the attacker had transferred the tokens to his wallet without any prior involvement.
“A hacker just sent 93.5M $THEO from the @Autheo_Network exploit to my wallet,” the user wrote.
Zynex said he had not moved, sold, or exchanged the tokens after receiving them.
“Not mine. Didn’t touch it. Not selling, not swapping, not moving,” he stated.
The user publicly requested an official return address from Autheo and offered to transfer the entire amount back to the project.
A transaction link shared in the post pointed to BaseScan, while an accompanying portfolio screenshot displayed a valuation exceeding $1 million for the wallet’s holdings.
However, the displayed valuation does not establish how much the tokens could actually be sold for, particularly following the reported price collapse and disruption to market liquidity.
The recipient’s account of the transfer has not been independently verified, and Autheo has not publicly confirmed whether the tokens belong to the project or provided a recovery address in the supplied statements.
Autheo warns users against trading THEO during investigation
Following the security incident, Autheo instructed token holders to stop all buying, selling, and bridging activity until the development team issues an official clearance.
The warning covered interactions with suspicious contracts and links, particularly those claiming to offer recovery services or compensation for affected users.
Autheo cautioned holders against sharing private keys or seed phrases and warned that impersonators could attempt to exploit confusion surrounding the incident.
The project directed users seeking transaction assistance to [email protected] and said verified updates would be published exclusively through its official communication channels.
No recovery timeline, compensation arrangement, or confirmed date for resuming normal token activity was provided in the security notice.
Bridge exploits have previously led to unauthorized token creation
The reported THEO incident follows several cross-chain security breaches in which attackers created tokens without the corresponding assets required to back them.
In August, The Sandbox suffered a bridge exploit that allowed unauthorized SAND tokens to be created on Base and BNB Smart Chain.
As crypto.news previously reported, the project disabled affected bridging routes while maintaining that SAND held on Ethereum and Polygon remained secure.
The Sandbox said the incident affected less than 0.01% of the token’s total supply, although security researchers identified substantially larger amounts of unbacked tokens created through the compromised infrastructure.
A separate investigation into the Sandbox exploit detailed how attackers manipulated LayerZero delegate permissions and generated hundreds of billions of dollars in nominal token value. The amount actually extracted was far smaller because available reserves limited what could be redeemed.
In July, trading protocol AFX lost approximately $24.15 million in USDC after an attacker targeted its cross-chain bridge. Blockchain investigators traced the stolen funds to Ethereum, where they were converted into ETH.
Another incident involving Humanity Protocol in June was traced to compromised administrative keys controlling its Hyperlane bridge contracts.
According to the project’s subsequent investigation, attackers obtained access to bridge administration systems after an employee’s laptop was compromised. The breach allowed malicious contract upgrades and unauthorized token creation across multiple networks.
Humanity Protocol estimated losses exceeding $36 million during the incident and advised users to avoid affected bridge infrastructure while investigators worked to contain the attack.
