Autheo’s THEO token reportedly lost 92% of its value within 24 hours after a suspected bridge exploit allowed an attacker to create unauthorized tokens on Base.
The project issued a security notice on October 13, confirming that its developers were investigating the incident. It urged holders to avoid buying, selling or bridging THEO until further updates are released.
Autheo has not yet confirmed the cause of the incident, the total number of tokens affected or the extent of the financial damage.
PeckShield Reports $1.76 Million in Token Sales
Blockchain security firm PeckShield reported that an attacker minted 19 million THEO tokens on Base and exchanged them for 700.8 ETH, worth approximately $1.76 million at the time.
According to the firm, the proceeds were then transferred to Ethereum. PeckShield also reported the token’s 92% price decline following the incident.
A separate account from crypto researcher Vlad suggested that approximately 119 million THEO tokens had been minted without authorization. The researcher linked the activity to a suspected vulnerability involving the project’s Hyperlane bridge infrastructure and claimed that subsequent token sales contributed to the price collapse.
Those findings remain unconfirmed by Autheo. The available information also does not establish whether PeckShield’s 19 million-token figure represents part of the larger amount reported by Vlad.
The mention of Hyperlane does not establish that a flaw in the protocol itself caused the incident. Autheo has yet to explain how the alleged unauthorized minting occurred.
Wallet Holder Says He Received 93.5 Million THEO
The investigation took another turn when an X user known as Zynex claimed that a wallet associated with the alleged attacker had sent him 93.5 million THEO tokens.
Zynex said he had no involvement in the incident and had not sold, swapped or moved the tokens. He publicly asked Autheo to provide an official return address so he could send them back.
His post included a BaseScan transaction link and a portfolio screenshot showing holdings valued at more than $1 million. However, that displayed value does not prove the tokens could be sold for that amount, especially amid falling prices and limited liquidity.
The account of the transfer has not been independently verified in the supplied reporting. Autheo has also not confirmed a recovery arrangement for those tokens.
Autheo Urges Holders to Pause Token Activity
While its developers investigate, Autheo has asked users to stop trading and bridging THEO until the team gives official clearance.
The project also warned holders about suspicious contracts, fraudulent recovery offers and impersonators claiming to provide compensation. Users were advised to keep their private keys and seed phrases confidential.
For transaction-related assistance, Autheo directed users to support@autheo.com. It said verified updates would come through its official communication channels.
The security notice did not include a recovery deadline, compensation plan or date for restoring normal token activity.
The Scale of the Incident Remains Unclear
The reported minting figures raise questions about the extent of the incident, but the number of unauthorized tokens should not be confused with the amount of money lost.
An attacker’s ability to profit from newly created tokens depends on available market liquidity. A large nominal token value can therefore be far higher than the amount actually extracted.
Previous incidents involving The Sandbox, AFX and Humanity Protocol have shown how compromised bridge systems or administrative access can enable unauthorized token creation or fund withdrawals. However, those cases do not establish what happened at Autheo.
For now, the key unanswered questions are how the tokens were allegedly minted, how much value was extracted and what steps Autheo will take to address the incident.
