Autheo’s THEO Plunges 92% After Suspected Bridge Exploit on Base

Autheo’s THEO token plunged 92.4% over 24 hours in its Hydrex Integral pool on Base after a suspected cross-chain mint exploit. GeckoTerminal data showed about $45,000 in liquidity in the THEO/USDC pool early on Oct. 13.

A BaseScan transaction records the creation of 19 million THEO at 1:06 p.m. ET on Oct. 12, credited to wallet `0x3048b4Ee…55079E0AD`. A subsequent swap transaction sent about 9.5 million THEO from that wallet into trading contracts and returned 189.06 $ETH to it.

Autheo acknowledged a security incident on Oct. 12 and warned users: “Do not buy, sell, or bridge THEO.” The instruction applies until an official all-clear, the project said. It also warned against unsolicited recovery or compensation offers.

THEO is the native utility coin of the Autheo blockchain, used for transaction fees and staking, according to the project’s website. Its Base token uses a HypERC20 cross-chain token implementation.

Cross-Chain Mint Authority

The mint transaction called the `process` function on the token’s cross-chain mailbox, the contract that receives messages from another chain. The submitting address was `0xeF305Ec5…1Ab930CE`.

Security monitor Defimon Alerts described the incident as an “unbacked cross-chain mint” and said the 19 million tokens had no corresponding backing lock on the origin chain. It identified the route’s security module as TrustedRelayerIsm, which relies on a single trusted relayer to authorize incoming messages.

Hyperlane’s source code for that module checks whether a message was processed by the trusted relayer. Autheo’s incident notice did not explain how the mint was authorized.

$ETH Moved to Ethereum

Eight subsequent swap transactions on Base paid a combined 292.16 $ETH to the mint recipient, according to The Defiant’s calculation of BaseScan’s listed $ETH transfers. That figure measures those eight payouts, not a comprehensive loss total.

The destination wallet’s total Ethereum balance stood at about 700.8 $ETH, worth roughly $1.76 million, early on Oct. 13. Its Ethereum transaction history also shows $ETH receipts before the Base mint.

One confirmed Relay bridge deposit sent 280.45 $ETH from the wallet on Base. The linked Ethereum transaction, carrying the same request identifier, paid 278.52 $ETH to the same address eight seconds later.