Autheo's THEO token has plunged more than 92% following a suspected cross-chain bridge exploit that reportedly allowed an attacker to mint millions of unauthorized tokens on Base. According to blockchain security firm PeckShield, the attacker minted 19 million THEO tokens on Base before exchanging them for 700.8 ETH worth approximately $1.76 million, which were then transferred to Ethereum. The security firm reported that THEO had fallen 92% over 24 hours following the incident, as reported by crypto.news. As per PeckShield, the transactions have raised questions about the security of the mechanism used to move THEO between blockchains, though the technical cause of the unauthorized issuance has not been confirmed.
Initial reports from blockchain researchers pointed to a possible vulnerability involving the Hyperlane cross-chain bridge infrastructure. According to an account operated by crypto researcher Vlad, the attacker minted approximately 119 million THEO tokens without authorization, an amount the researcher described as equivalent to roughly 70% of the token's supply. The researcher claimed the attacker subsequently sold tokens into available liquidity pools, contributing to the collapse in THEO's market price. PeckShield separately identified the transaction involving 19 million newly minted THEO tokens on Base, though neither figure has been confirmed by Autheo. The reported $1.76 million is the approximate value of ETH obtained through the swaps, not a verified estimate of total losses incurred by THEO holders.
An unusual transfer involving 93.5 million THEO tokens emerged as researchers examined transactions linked to the suspected attack. A verified X user operating under the name Zynex claimed that an address associated with the attacker had transferred the tokens to his wallet without any prior involvement. Zynex stated he had not moved, sold, or exchanged the tokens after receiving them, publicly requesting an official return address from Autheo and offering to transfer the entire amount back to the project. However, the recipient's account of the transfer has not been independently verified, and Autheo has not publicly confirmed whether the tokens belong to the project.
Following the security incident, Autheo instructed token holders to stop all buying, selling, and bridging activity until the development team issues an official clearance. In an October 13 security notice, Autheo confirmed that its development team was investigating an incident involving THEO and warned holders against buying, selling, or bridging the token until further notice. The project did not disclose the full extent of the breach, identify the vulnerability, or provide an estimate of financial losses. Autheo cautioned holders against sharing private keys or seed phrases and warned that impersonators could attempt to exploit confusion surrounding the incident. According to CoinMarketCap, THEO traded near $0.0060 at approximately 1:07 p.m. Kyiv time on October 13, down about 92.6% over the previous 24 hours.
The reported THEO incident follows several cross-chain security breaches in which attackers created tokens without the corresponding assets required to back them. In August, The Sandbox suffered a bridge exploit that allowed unauthorized SAND tokens to be created on Base and BNB Smart Chain, affecting less than 0.01% of the token's total supply. In July, trading protocol AFX lost approximately $24.15 million in USDC after an attacker targeted its cross-chain bridge, while Humanity Protocol estimated losses exceeding $36 million in June after compromised administrative keys controlled its Hyperlane bridge contracts. Autheo has not confirmed that Hyperlane was the source of the vulnerability or explained how unauthorized minting became possible. A possible cross-chain bridge exploit remains a hypothesis, not an established finding.
