Audit log

Every state-changing event for Autheo (THEO Token): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-15 12:05:30Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 457,231,381

   sig

   5UsZKftGvkVo…ov5uyJbvcopyexplorer ↗

   hash

   9qkJiqNNCm3i…rf3CqhWKcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (14212 B) ▸

   {"actor":"system:backfill","investigation_id":"666634e4-381e-4288-9ead-0ce8611d1c31","kind":"publish","page_slug":"autheo-theo-token","published_at":"2026-10-15T12:05:30.047Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Autheo (THEO Token)","sections":[{"content":"On October 12-13, 2026, approximately 19 million THEO tokens were minted on Base from the zero address with no corresponding collateral locked on the origin chain, according to on-chain monitoring firm PeckShield and reporting from Crypto Times. An orchestrator address allegedly pulled a portion of the minted supply and routed it through dozens of swaps across the THEO/USDC pool, Uniswap v4 positions, and Hydrex liquidity pools. PeckShield reported the minted tokens were ultimately swapped for roughly 700.8 ETH, worth approximately $1.76 million, which was then bridged to Ethereum mainnet. Separately, security monitor Defimon Alerts estimated total losses at approximately $1.7 million, though the figures from different trackers have not been fully reconciled. THEO's price fell from approximately $0.08 to roughly $0.006 within 24 hours, a decline of about 92%, according to Crypto Briefing and crypto.news. A researcher identified by the handle 'Vlad' separately claimed as many as 119 million THEO were minted, representing roughly 70% of supply, though this figure is unconfirmed and distinct from PeckShield's 19 million figure; Autheo has not validated either number. The precise root cause of the exploit has not been officially confirmed by Autheo as of October 13, 2026.","heading":"October 2026 Bridge Exploit and Unbacked Token Minting","severity":"critical","sources":[{"credibility":2,"name":"Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base - Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"credibility":2,"name":"Autheo THEO token plunges 92% after suspected bridge exploit - crypto.news","type":"news_article","url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"},{"credibility":2,"name":"Autheo's THEO plunges 92% after suspected bridge exploit on Base - The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/autheo-s-theo-plunges-92-after-suspected-bridge-exploit-on-base"},{"credibility":2,"name":"Autheo's THEO plunges 92% after suspected bridge exploit - Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/autheo-theo-plunges-suspected-bridge-exploit/"}]},{"content":"Multiple outlets reported that the exploited route's security module was a \"TrustedRelayerIsm,\" a Hyperlane interchain security module design that relies on a single trusted relayer to authorize incoming cross-chain messages. Crypto Times reported that the attacker used this single trusted relayer to mint 19 million unbacked THEO tokens. It is alleged, but not independently confirmed by Autheo or on-chain forensic disclosure, that the relayer's signing key was compromised; it remains unconfirmed whether the key was stolen, misconfigured, or misused by an authorized party. Autheo uses a Hyperlane-based bridge connecting its own mainnet, Base, and Robinhood Chain. This single-relayer design represents a centralized point of failure in an otherwise \"trust-minimized\" cross-chain messaging framework, a structural risk pattern that commentators compared to other 2026 bridge incidents involving compromised or over-privileged keys, including the Humanity Protocol exploit in June 2026.","heading":"Alleged Mechanism: Centralized Relayer Key on Hyperlane Bridge","severity":"critical","sources":[{"credibility":2,"name":"Autheo's THEO Plunges 92% After Suspected Bridge Exploit on Base - PrimeXBT","type":"news_article","url":"https://primexbt.com/news/autheos-theo-plunges-92-after-suspected-bridge-exploit-on-base/"},{"credibility":2,"name":"Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base - Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"}]},{"content":"Before the October 2026 incident, THEO's bridge and related contracts had reportedly been reviewed by three separate security firms: Halborn, CertiK, and Avelar Labs. Tech Report, summarizing the incident, noted that all three firms had audited THEO prior to the exploit, but that none of the published audits appear to have flagged the centralized single-relayer key as a systemic point of failure. Autheo's own August 2026 launch announcement stated that Avelar Labs had audited the bridge connecting Base and the Autheo Mainnet. Tech Report observed that an audit generally reviews the contracts as configured at a specific point in time, and does not necessarily capture later configuration changes or risks inherent to the broader bridge architecture, such as reliance on a single trusted relayer. It is not publicly known whether the audits scoped in the relayer/ISM configuration that was ultimately exploited, since the audit reports' contents and scope have not been independently published or reviewed in the available reporting.","heading":"Prior Security Audits Did Not Prevent the Exploit","severity":"high","sources":[{"credibility":2,"name":"THEO hack: audited three times, exploited anyway - Tech Report","type":"news_article","url":"https://techreport.com/news/software/theo-hack-funds-off-base-recovery-hard/"}]},{"content":"On October 12, 2026 at approximately 21:14 UTC, Autheo posted a security notice stating its team was investigating an incident involving THEO, telling holders \"Do not buy, sell, or bridge THEO\" until the team issued an official all-clear. The notice directed users with transaction concerns to a support email address and warned against scams, including impersonators and unsolicited fund-recovery offers, and reminded users never to share private keys or seed phrases. As of October 13, 2026, Autheo had not released a technical postmortem, confirmed the scope or total value of losses, disclosed the specific vulnerability exploited, identified whether the relayer key was stolen or misused, or announced a remediation or compensation plan. The exchange MEXC, which had listed THEO on October 1, 2026, suspended THEO deposits and withdrawals on October 13 at Autheo's request. Separately, a wallet holder using the handle \"Zynex\" publicly stated he had received 93.5 million THEO tokens from an address linked to the attacker and offered to return them, though Autheo had not published a verified return address as of the reporting date.","heading":"Autheo's Response and Lack of Disclosure","severity":"high","sources":[{"credibility":2,"name":"Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base - Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"credibility":2,"name":"Autheo THEO token plunges 92% after suspected bridge exploit - crypto.news","type":"news_article","url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"}]},{"content":"As of October 13, 2026, no recovery of the stolen funds had been reported and no remediation timeline had been announced. Tech Report noted that the proceeds of the exploit (reported as roughly 700.8 ETH, or approximately $1.76 million) had moved off Base to Ethereum mainnet, and observed that the cryptocurrency industry generally has no standing mechanism to reverse a theft once funds have been moved and mixed across chains. Whether any portion of the minted or stolen tokens will ultimately be recovered, including the 93.5 million THEO one holder claimed to be willing to return, remained unresolved in available reporting.","heading":"Fund Recovery Status","severity":"medium","sources":[{"credibility":2,"name":"THEO hack: audited three times, exploited anyway - Tech Report","type":"news_article","url":"https://techreport.com/news/software/theo-hack-funds-off-base-recovery-hard/"},{"credibility":2,"name":"Autheo THEO token plunges 92% after suspected bridge exploit - crypto.news","type":"news_article","url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"}]},{"content":"Autheo describes itself as building an \"Internet Operating System,\" with its own mainnet going live on May 14, 2026, initially handling staking and transaction fees while compute, storage, AI inference, and identity functions were still being rolled out according to the company's own announcements. THEO began trading in August 2026 at a reference price of approximately $0.05, implying an initial market capitalization near $18.66 million and a fully diluted valuation near $350 million, against a stated maximum supply of 7 billion tokens with roughly 5.3% circulating at launch, according to the project's own launch materials. THEO was also connected to Robinhood Chain, a separate Arbitrum Orbit-based layer-2 network launched by Robinhood in mid-2026, via Autheo's cross-chain bridge infrastructure. By the time of the October exploit, THEO had reportedly traded around $0.08 and had been listed on the exchange MEXC as of October 1, 2026. These figures derive substantially from Autheo's own press materials and have not been independently verified by this investigation.","heading":"Background: Autheo and THEO Launch","severity":"low","sources":[{"credibility":2,"name":"Autheo's THEO plunges 92% after suspected bridge exploit on Base - Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/autheo-theo-plunges-suspected-bridge-exploit/"}]}],"sources_used":[{"credibility":2,"name":"Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base - Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"credibility":2,"name":"THEO hack: audited three times, exploited anyway - Tech Report","type":"news_article","url":"https://techreport.com/news/software/theo-hack-funds-off-base-recovery-hard/"},{"credibility":2,"name":"Autheo THEO token plunges 92% after suspected bridge exploit - crypto.news","type":"news_article","url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"},{"credibility":2,"name":"Autheo's THEO plunges 92% after suspected bridge exploit on Base - The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/autheo-s-theo-plunges-92-after-suspected-bridge-exploit-on-base"},{"credibility":2,"name":"Autheo's THEO plunges 92% after suspected bridge exploit on Base - Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/autheo-theo-plunges-suspected-bridge-exploit/"},{"credibility":2,"name":"Autheo's THEO Plunges 92% After Suspected Bridge Exploit on Base - PrimeXBT","type":"news_article","url":"https://primexbt.com/news/autheos-theo-plunges-92-after-suspected-bridge-exploit-on-base/"}],"summary":"THEO is the native token of Autheo, a project describing itself as an \"Internet Operating System\" whose mainnet launched May 14, 2026 and whose token began trading in August 2026. On October 12-13, 2026, an attacker allegedly exploited Autheo's Hyperlane-based cross-chain bridge on Base, minting roughly 19 million unbacked THEO tokens with no matching collateral, then swapping a portion for approximately 700.8 ETH (about $1.76 million) before bridging the proceeds to Ethereum. THEO's price fell approximately 92% within 24 hours. The root cause remains officially unconfirmed as of this writing, though multiple outlets attribute the mint to a single trusted relayer underpinning the bridge's security module, and the token had passed prior security audits from Halborn, CertiK, and Avelar Labs.","timeline":[{"date":"2026-05-14","date_evidence":"Autheo Mainnet went live on May 14, 2026","event":"Autheo Mainnet launches, initially handling staking and transaction fees.","source":"Autheo blog / Tech Report summary","source_url":"https://techreport.com/news/software/theo-hack-funds-off-base-recovery-hard/"},{"date":"2026-08","event":"THEO token begins trading; Autheo's launch announcement states Avelar Labs audited the bridge between Base and Autheo Mainnet, at a reference price of approximately $0.05.","source":"Crypto Briefing / Tech Report","source_url":"https://cryptobriefing.com/autheo-theo-plunges-suspected-bridge-exploit/"},{"date":"2026-10","date_original":"2026-10-01","event":"THEO is listed for trading on the MEXC exchange.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"date":"2026-10","date_original":"2026-10-12","event":"Attacker allegedly mints approximately 19 million unbacked THEO tokens on Base via the Hyperlane-based bridge, exploiting a single trusted relayer key; minted tokens are swapped for roughly 700.8 ETH (~$1.76 million), later bridged to Ethereum mainnet.","source":"PeckShield, via Crypto Times and crypto.news","source_url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"date":"2026-10","date_evidence":"Autheo posted an urgent security notice on X. It said it was investigating an incident involving THEO and told users 'not to buy, sell, or bridge the token' until an official all-clear.","date_original":"2026-10-12","event":"Autheo posts a security notice at approximately 21:14 UTC warning holders not to buy, sell, or bridge THEO pending investigation.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"date":"2026-10","date_original":"2026-10-13","event":"THEO price falls approximately 92% within 24 hours, from roughly $0.08 to about $0.006; MEXC suspends THEO deposits and withdrawals at Autheo's request.","source":"crypto.news / Crypto Times","source_url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7f84bbac-3f09-43cd-8e77-d68f2070bd9bcopy