Audit log

Every state-changing event for Autheo (THEO Token) — Hyperlane Bridge Exploit: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-16 23:02:51Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 457,813,481

   sig

   4ex3NLpAcLVJ…XVeeMqbCcopyexplorer ↗

   hash

   4QJjVUvYmxLD…45pSZXHUcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (14936 B) ▸

   {"actor":"system:backfill","investigation_id":"d0c4f1db-0cba-4823-8435-5bb930d8f9f8","kind":"publish","page_slug":"autheo-theo-token-hyperlane-bridge-exploit","published_at":"2026-10-16T23:02:51.540Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Autheo (THEO Token) — Hyperlane Bridge Exploit","sections":[{"content":"Autheo Networks was founded in 2024 by Todd Mortenson and Scott Bayless. The project describes itself as a Layer-0 Operating System with an integrated Layer-1 blockchain, combining identity, compute, storage, developer tooling, and AI capabilities. Autheo's mainnet launched on May 14, 2026, following more than five years of claimed development. The THEO token began trading on August 20, 2026, at a reference price of $0.05 per token on Hydrex, a Base-native decentralized exchange. At launch, Autheo reported a fully diluted valuation of approximately $350 million and a maximum token supply of 7.0 billion. The project uses a Hyperlane-based cross-chain bridge to move THEO between its own mainnet, Base, and Robinhood Chain.","heading":"Project Background","severity":"low","sources":[{"credibility":2,"name":"Autheo: THEO Token Launch Press Release","type":"official","url":"https://www.autheo.com/press/theo-token-launch-hydrex-listing"},{"credibility":2,"name":"Autheo: THEO Now Live on Hydrex","type":"official","url":"https://www.autheo.com/press/theo-now-live-on-hydrex"}]},{"content":"On October 12, 2026, at approximately 21:14 UTC, Autheo issued an urgent security notice indicating an ongoing investigation into unauthorized activity. Security monitoring firms Defimon Alerts and PeckShield published analyses on October 13, 2026, describing the incident as an unbacked cross-chain mint.\n\nAccording to Defimon Alerts and PeckShield, the THEO contract on Base was protected by Hyperlane's TrustedRelayerIsm security module. This module grants a single relayer address permission to execute arbitrary cross-chain messages without requiring validator signatures or any multi-party verification. Hyperlane's own production documentation notes that new warp-route deployments use TrustedRelayerIsm by default for testing convenience and that teams are expected to replace it before going to production.\n\nAn attacker reportedly delivered a Hyperlane message from origin domain 2127 — corresponding to Autheo's EVM chain identifier — triggering the handle function on the Base-side THEO contract and minting 19 million tokens from the zero address with no matching collateral locked on the origin chain. The submitting address was reported to begin with 0xeF305Ec5. An orchestrator address beginning with 0x599b then extracted approximately 9.5 million of the newly minted tokens and executed approximately 54 swap transactions across THEO/USDC pools, Uniswap v4 positions, and Hydrex pools on Base, yielding an estimated 700.8 ETH (approximately $1.76 million). Those funds were subsequently bridged from Base to Ethereum mainnet.\n\nAutheo has not confirmed these technical details as the definitive root cause, and the official root cause remained unconfirmed as of the time of reporting. Whether the trusted relayer key was compromised by an external attacker, was misconfigured, or was otherwise misused has not been publicly determined by Autheo.","heading":"The Exploit: Unauthorized Token Minting via Hyperlane Bridge","severity":"critical","sources":[{"credibility":2,"name":"Crypto Times: Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"credibility":2,"name":"Crypto Briefing: Autheo THEO Plunges 92% After Suspected Bridge Exploit on Base","type":"news_article","url":"https://cryptobriefing.com/autheo-theo-plunges-suspected-bridge-exploit/"},{"credibility":2,"name":"crypto.news: Autheo THEO Token Plunges 92% After Suspected Bridge Exploit","type":"news_article","url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"},{"credibility":2,"name":"TechReport: THEO Hack — Audited Three Times, Exploited Anyway","type":"news_article","url":"https://techreport.com/news/software/theo-hack-funds-off-base-recovery-hard/"}]},{"content":"Prior to the exploit, THEO traded at approximately $0.08 per token. Within 24 hours of the unauthorized mint, the token price had fallen to approximately $0.006, representing a decline of roughly 92%. Reporters noted that thin liquidity on Hydrex and other Base trading venues amplified the sell pressure from the attacker's swap activity.\n\nOn October 13, 2026, MEXC exchange suspended THEO deposits and withdrawals at Autheo's request. Autheo's security notice warned holders not to buy, sell, or bridge THEO pending investigation, and cautioned against unsolicited recovery or compensation offers, suspicious links and contracts, and sharing private keys or seed phrases. Users with transaction concerns were directed to support@autheo.com.","heading":"Price Impact and Market Response","severity":"critical","sources":[{"credibility":2,"name":"Crypto Briefing: Autheo THEO Plunges 92% After Suspected Bridge Exploit on Base","type":"news_article","url":"https://cryptobriefing.com/autheo-theo-plunges-suspected-bridge-exploit/"},{"credibility":2,"name":"Crypto Times: Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"credibility":2,"name":"KuCoin: THEO Token Price Drops 92% After Suspected $1.76M ETH Exploit on Base","type":"news_article","url":"https://www.kucoin.com/news/flash/theo-token-price-drops-92-after-suspected-1-76m-eth-exploit-on-base"}]},{"content":"Before the exploit, Autheo disclosed that three separate security firms had reviewed components of its infrastructure. According to Autheo's own press materials, Halborn audited the testnet and validator deployment platform and onboarding infrastructure; CertiK audited the mainnet and vesting contracts; and Avelar Labs audited the Base-to-Autheo bridge. A fourth firm, referenced in some sources as 'Advar Labs,' may refer to the same Avelar Labs engagement under a variant spelling — this discrepancy has not been clarified by Autheo.\n\nNone of the three audits is publicly reported to have flagged the bridge's use of TrustedRelayerIsm as a production security risk. Industry commentary following the exploit noted that the TrustedRelayerIsm module is explicitly described in Hyperlane's own documentation as a testing-convenience default that should be replaced before production deployment. Whether any audit firm reviewed the bridge configuration in its final production state, and whether auditors were given access to the specific bridge module configuration that was exploited, has not been confirmed by Autheo or the audit firms as of the time of reporting.\n\nThe incident has prompted broader commentary about scope limitations in smart-contract audits — specifically, whether production infrastructure configuration (as distinct from contract code) falls within typical audit mandates.","heading":"Security Audit History and Scope Limitations","severity":"high","sources":[{"credibility":2,"name":"TechReport: THEO Hack — Audited Three Times, Exploited Anyway","type":"news_article","url":"https://techreport.com/news/software/theo-hack-funds-off-base-recovery-hard/"},{"credibility":2,"name":"Autheo: THEO Token Launch Press Release (audit disclosures)","type":"official","url":"https://www.autheo.com/press/theo-token-launch-hydrex-listing"},{"credibility":2,"name":"Crypto Times: Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"}]},{"content":"According to analyses published by Defimon Alerts and PeckShield and reported by Crypto Times, the attack originated from a submitting address beginning with 0xeF305Ec5 and was orchestrated by a wallet beginning with 0x599b. The Base-side THEO token contract address is 0xebE516a20238F79DC20b07eaD6768e08891Ed309. Approximately 9.5 million of the 19 million minted tokens were used in approximately 54 swap transactions to obtain an estimated 700.8 ETH, which was then bridged to Ethereum mainnet.\n\nA separate report from crypto.news cited a researcher named Vlad who claimed approximately 119 million THEO tokens — reportedly around 70% of the total supply — were created without authorization, and that 93.5 million tokens were sent to a wallet identified as 'Zynex,' whose operator claimed to have received the tokens unsolicited. These claims are substantially larger than the 19 million figure cited by PeckShield and have not been independently corroborated. They should be treated as low-confidence pending further on-chain verification.","heading":"On-Chain and Attribution Details","severity":"high","sources":[{"credibility":2,"name":"Crypto Times: Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"credibility":2,"name":"crypto.news: Autheo THEO Token Plunges 92% After Suspected Bridge Exploit","type":"news_article","url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"},{"credibility":2,"name":"Coinpedia: THEO Bridge Exploit After $1.76M ETH Transfer, Price Drops 92%","type":"news_article","url":"https://coinpedia.org/news/theo-bridge-exploit-after-1-76m-eth-transfer-price-drops-92/"}]},{"content":"As of October 13, 2026, Autheo had acknowledged a security incident and instructed token holders not to buy, sell, or bridge THEO pending investigation. The project had not released a technical postmortem, confirmed the root cause, announced a compensation or recovery plan, or provided a timeline for resuming normal token operations. MEXC suspended THEO deposits and withdrawals at Autheo's request on October 13, 2026.\n\nNo law enforcement action, regulatory filing, or formal incident report has been publicly disclosed. No information is available indicating recovered funds or an identified perpetrator. This page will be updated as new information becomes available.","heading":"Official Response and Recovery Status","severity":"high","sources":[{"credibility":2,"name":"crypto.news: Autheo THEO Token Plunges 92% After Suspected Bridge Exploit","type":"news_article","url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"},{"credibility":2,"name":"TechReport: THEO Hack — Audited Three Times, Exploited Anyway","type":"news_article","url":"https://techreport.com/news/software/theo-hack-funds-off-base-recovery-hard/"}]}],"sources_used":[{"credibility":2,"name":"Crypto Briefing: Autheo THEO Plunges 92% After Suspected Bridge Exploit on Base","type":"news_article","url":"https://cryptobriefing.com/autheo-theo-plunges-suspected-bridge-exploit/"},{"credibility":2,"name":"Crypto Times: Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"credibility":2,"name":"TechReport: THEO Hack — Audited Three Times, Exploited Anyway","type":"news_article","url":"https://techreport.com/news/software/theo-hack-funds-off-base-recovery-hard/"},{"credibility":2,"name":"Coinpedia: THEO Bridge Exploit After $1.76M ETH Transfer, Price Drops 92%","type":"news_article","url":"https://coinpedia.org/news/theo-bridge-exploit-after-1-76m-eth-transfer-price-drops-92/"},{"credibility":2,"name":"crypto.news: Autheo THEO Token Plunges 92% After Suspected Bridge Exploit","type":"news_article","url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"},{"credibility":2,"name":"KuCoin: THEO Token Price Drops 92% After Suspected $1.76M ETH Exploit on Base","type":"news_article","url":"https://www.kucoin.com/news/flash/theo-token-price-drops-92-after-suspected-1-76m-eth-exploit-on-base"},{"credibility":2,"name":"Autheo Press Release: THEO Token Launch and Hydrex Listing","type":"official","url":"https://www.autheo.com/press/theo-token-launch-hydrex-listing"},{"credibility":2,"name":"Autheo Press Release: THEO Now Live on Hydrex","type":"official","url":"https://www.autheo.com/press/theo-now-live-on-hydrex"}],"summary":"Autheo Networks is a Layer-0/Layer-1 blockchain project founded in 2024 whose native THEO token launched on Hydrex in August 2026. On October 12, 2026, an attacker exploited a single trusted-relayer key in the project's Hyperlane bridge on Base to mint 19 million unbacked THEO tokens, swapping approximately 9.5 million of them for roughly 700.8 ETH (~$1.76 million) across approximately 54 transactions before bridging the proceeds to Ethereum mainnet. The resulting sell pressure caused THEO to lose approximately 92% of its value within 24 hours. As of publication, Autheo has not released a technical postmortem, confirmed root cause, or announced a recovery or compensation plan.","timeline":[{"date":"2024-01-01","event":"Autheo Networks founded by Todd Mortenson and Scott Bayless.","source":"Autheo Press Release","source_url":"https://www.autheo.com/press/theo-token-launch-hydrex-listing"},{"date":"2026-05-14","event":"Autheo mainnet launches.","source":"TechReport","source_url":"https://techreport.com/news/software/theo-hack-funds-off-base-recovery-hard/"},{"date":"2026-08-20","event":"THEO token begins trading on Hydrex at a reference price of $0.05 per token.","source":"Autheo Press Release","source_url":"https://www.autheo.com/press/theo-token-launch-hydrex-listing"},{"date":"2026-10-12","event":"An attacker allegedly exploits the TrustedRelayerIsm module in Autheo's Hyperlane bridge on Base, minting 19 million unbacked THEO tokens and swapping approximately 9.5 million for roughly 700.8 ETH across approximately 54 transactions. At approximately 21:14 UTC, Autheo issues an urgent security advisory instructing users not to buy, sell, or bridge THEO.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"date":"2026-10-13","event":"Security firms Defimon Alerts and PeckShield publish analyses of the attack. MEXC suspends THEO deposits and withdrawals at Autheo's request. THEO price falls approximately 92%, from roughly $0.08 to $0.006. Funds estimated at 700.8 ETH (~$1.76M) are reported bridged from Base to Ethereum mainnet.","source":"Crypto Briefing","source_url":"https://cryptobriefing.com/autheo-theo-plunges-suspected-bridge-exploit/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 25d40764-2ef2-41bd-a3b7-bf11f38092c1copy