Verify a decision

{"actor":"system:backfill","investigation_id":"7c099136-6b29-4252-82c4-4d70b5c6c55d","kind":"publish","page_slug":"autheo-theo-bridge-exploit-october-2026","published_at":"2026-10-13T20:06:20.633Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Autheo THEO Bridge Exploit (October 2026)","sections":[{"content":"According to The Crypto Times, the THEO token's contract on Base was secured by a TrustedRelayerIsm module within Autheo's Hyperlane warp-route bridge, a configuration that allows a single relayer address to execute cross-chain messages without validator signatures or other multi-party verification. The outlet reported that Hyperlane's own documentation describes this module as intended for testing new warp routes and advises removing it before production use. On October 12, 2026, an attacker allegedly sent a cross-chain message using an origin domain matching Autheo's EVM chain ID, resulting in the minting of approximately 19 million THEO from the zero address with no corresponding collateral locked on the origin chain. Whether the relayer key was compromised, misconfigured, or misused by an authorized party has not been confirmed by Autheo. Coinpedia and crypto.news both reported that, as of October 13, 2026, Autheo had not identified the specific vulnerability, confirmed Hyperlane as the point of failure, or explained how the unauthorized minting occurred. This section should be read as describing an alleged and still-under-investigation mechanism rather than a confirmed root cause.","heading":"The Exploit: Suspected Trusted-Relayer Bridge Vulnerability","severity":"critical","sources":[{"credibility":2,"name":"Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base — The Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"credibility":2,"name":"Autheo THEO token plunges 92% after suspected bridge exploit — crypto.news","type":"news_article","url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"},{"credibility":2,"name":"THEO Bridge Exploit After $1.76M ETH Transfer, Price Drops 92% — Coinpedia","type":"news_article","url":"https://coinpedia.org/news/theo-bridge-exploit-after-1-76m-eth-transfer-price-drops-92/"}]},{"content":"Security firm PeckShield reported that the attacker minted about 19 million THEO on Base and swapped a portion of it, approximately 9.5 million tokens, through roughly 54 trades across the THEO/USDC pool, Uniswap v4 positions, and Hydrex liquidity pools, extracting an estimated $700,000 in WETH, USDC, and cbBTC according to The Crypto Times. PeckShield further reported that the attacker's wallet held 700.8 ETH (approximately $1.76 million at the time), which Coinpedia reported was partly bridged from Base to Ethereum mainnet (280.45 ETH sent, 278.52 ETH received on the other side). Coinpedia noted that the 700.8 ETH figure represented the wallet's total balance rather than a confirmed stolen amount, since the wallet had reportedly received ETH before the incident, making the precise loss figure uncertain. THEO's price fell from roughly $0.08 to approximately $0.006 (Coinpedia cited $0.006262) within about 24 hours, a decline of roughly 92%, which multiple outlets attributed partly to thin liquidity on Base-based venues such as Hydrex amplifying the sell pressure from the minted tokens. Monitoring service Defimon Alerts described the incident as an 'unbacked cross-chain mint' and estimated total losses at approximately $1.7 million, broadly consistent with PeckShield's figures.","heading":"Financial Impact: ETH Extraction and 92% Price Collapse","severity":"critical","sources":[{"credibility":2,"name":"Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base — The Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"credibility":2,"name":"THEO Bridge Exploit After $1.76M ETH Transfer, Price Drops 92% — Coinpedia","type":"news_article","url":"https://coinpedia.org/news/theo-bridge-exploit-after-1-76m-eth-transfer-price-drops-92/"}]},{"content":"Figures for the size of the unauthorized mint are inconsistent across sources. PeckShield's widely cited figure is approximately 19 million THEO minted and swapped for 700.8 ETH. However, a researcher identified by crypto.news only as 'Vlad' claimed on social media that 119 million THEO were minted, representing roughly 70% of circulating supply; Autheo has not confirmed this higher figure. Separately, a wallet holder identified as 'Zynex' reportedly stated that they received 93.5 million THEO from an address linked to the attacker and offered to return the tokens; this claim is also unverified by Autheo or independent on-chain analysis cited in available reporting. Because these secondary figures originate from unverified social-media statements rather than confirmed on-chain forensics or an Autheo postmortem, they should be treated as low-confidence and are flagged accordingly.","heading":"Conflicting and Unverified Claims About Mint Size","severity":"medium","sources":[{"credibility":2,"name":"Autheo THEO token plunges 92% after suspected bridge exploit — crypto.news","type":"news_article","url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"}]},{"content":"According to crypto.news and Coinpedia, Autheo posted an urgent notice on X on October 12, 2026 (reported by The Crypto Times as posted at 21:14 UTC) stating that its development team was investigating a security incident involving THEO and instructing holders not to buy, sell, or bridge THEO until the company issued an all-clear. The notice reportedly directed users with transaction concerns to support@autheo.com and warned holders about impersonators and unsolicited fund-recovery offers, as well as against sharing private keys or seed phrases. As of October 13, 2026, Autheo had not released a technical postmortem, confirmed the root cause, disclosed the full scope of losses, announced a compensation plan, or given a timeline for resuming normal trading and bridging activity.","heading":"Autheo's Response","severity":"high","sources":[{"credibility":2,"name":"Autheo THEO token plunges 92% after suspected bridge exploit — crypto.news","type":"news_article","url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"},{"credibility":2,"name":"THEO Bridge Exploit After $1.76M ETH Transfer, Price Drops 92% — Coinpedia","type":"news_article","url":"https://coinpedia.org/news/theo-bridge-exploit-after-1-76m-eth-transfer-price-drops-92/"},{"credibility":2,"name":"Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base — The Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"}]},{"content":"The Crypto Times reported that MEXC, which had listed a THEO/USDT market on October 1, 2026, suspended THEO deposits and withdrawals on October 13, 2026 at Autheo's request as the investigation began. This exchange-halt claim was not independently corroborated in other outlets reviewed for this investigation (crypto.news and Coinpedia reported no exchange-level actions), so it is flagged as a single-source, medium-confidence claim pending further corroboration. Multiple outlets agreed that thin on-chain liquidity on Base-native venues such as Hydrex, where THEO primarily traded, made the token unusually vulnerable to the rapid price collapse once the minted supply was sold into pools.","heading":"Exchange and Market Reaction","severity":"medium","sources":[{"credibility":2,"name":"Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base — The Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"}]},{"content":"Autheo describes itself as a Layer-0 'internet operating system' with an integrated Layer-1 blockchain; The Crypto Times' coverage of the exploit notes Autheo's mainnet launched on May 14, 2026. THEO, the project's native token, began public trading on Hydrex, a Base-native decentralized exchange, around August 20, 2026, at a reference price near $0.05. Autheo's own announcements, cited in background research for this investigation, stated that its infrastructure had been audited by multiple firms, including Avelar Labs for the Base-to-Autheo bridge specifically — the same bridge subsequently implicated in this incident. This apparent gap between a stated prior audit and the alleged relayer-configuration weakness has not been explained by Autheo or by the auditors in reporting reviewed for this page.","heading":"Background: Autheo and THEO Token","severity":"medium","sources":[{"credibility":2,"name":"Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base — The Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"}]}],"sources_used":[{"credibility":2,"name":"Autheo's THEO Plunges 92% After Suspected Bridge Exploit on Base — The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/autheo-s-theo-plunges-92-after-suspected-bridge-exploit-on-base"},{"credibility":2,"name":"Autheo THEO token plunges 92% after suspected bridge exploit — crypto.news","type":"news_article","url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"},{"credibility":2,"name":"Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base — The Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"credibility":2,"name":"THEO Bridge Exploit After $1.76M ETH Transfer, Price Drops 92% — Coinpedia","type":"news_article","url":"https://coinpedia.org/news/theo-bridge-exploit-after-1-76m-eth-transfer-price-drops-92/"}],"summary":"On October 12, 2026, an attacker allegedly exploited a single-trusted-relayer vulnerability in Autheo's Hyperlane-based bridge on Base, minting roughly 19 million unbacked THEO tokens and swapping a portion of them for about 700.8 ETH (approximately $1.76 million), which was then bridged to Ethereum mainnet. THEO's price collapsed roughly 92% within about 24 hours, and Autheo told holders not to buy, sell, or bridge THEO while its team investigates; as of this writing the project has not confirmed the root cause, the full scope of losses, or issued a technical postmortem.","timeline":[{"date":"2026-08","event":"THEO begins public trading on Hydrex, a Base-native decentralized exchange, at a reference price near $0.05.","source":"The Crypto Times","source_url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"date":"2026-10","date_original":"2026-10-12","event":"An attacker allegedly exploits a single-trusted-relayer vulnerability in Autheo's Hyperlane bridge on Base, minting approximately 19 million unbacked THEO tokens from the zero address.","source":"PeckShield, reported by The Crypto Times and Coinpedia","source_url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"date":"2026-10","date_original":"2026-10-12","event":"Roughly 9.5 million of the minted THEO are swapped through about 54 trades across Base liquidity pools; the attacker's wallet is reported to hold 700.8 ETH (approximately $1.76 million), later partly bridged to Ethereum mainnet.","source":"PeckShield, reported by The Crypto Times and Coinpedia","source_url":"https://coinpedia.org/news/theo-bridge-exploit-after-1-76m-eth-transfer-price-drops-92/"},{"date":"2026-10-12","date_evidence":"On October 12, 2026 at 21:14 UTC, Autheo posted an urgent notice on X saying it was investigating and advising users not to buy, sell, or bridge THEO until it issues an all-clear.","event":"Autheo posts an urgent notice on X telling holders not to buy, sell, or bridge THEO while it investigates a security incident.","source":"The Crypto Times","source_url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"},{"date":"2026-10","date_original":"2026-10-13","event":"THEO's price falls roughly 92% within about 24 hours of the exploit, from approximately $0.08 to around $0.006.","source":"PeckShield, reported by Coinpedia and crypto.news","source_url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"},{"date":"2026-10","date_original":"2026-10-13","event":"A researcher claims 119 million THEO were minted, far above the 19 million figure reported by PeckShield; Autheo has not confirmed this figure. A separate wallet holder claims to have received 93.5 million THEO from an address linked to the attacker.","source":"crypto.news","source_url":"https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit/"},{"date":"2026-10","date_original":"2026-10-13","event":"MEXC reportedly suspends THEO deposits and withdrawals at Autheo's request as the investigation continues (single-source report).","source":"The Crypto Times","source_url":"https://www.cryptotimes.io/2026/10/13/autheo-theo-crashes-over-90-after-1-7m-hyperlane-bridge-exploit-on-base/"}]},"v":1}