Quick answer: In the Autheo THEO exploit, an attacker minted 19 million unbacked THEO on Base on Oct. 12, 2026, through Autheo’s Hyperlane bridge and swapped them for 700.8 ETH, about $1.76 million, per PeckShield. THEO fell about 92%, to roughly $0.0061 on Oct. 13, per GeckoTerminal.
The Autheo THEO exploit wiped out about 92% of the token’s value in a single hour on Oct. 12, 2026. An attacker used Autheo’s Hyperlane bridge to mint 19 million unbacked THEO on Base, then sold them for about 700.8 ETH, worth roughly $1.76 million, according to PeckShield alerts cited by crypto.news.
At 14:07 UTC on Oct. 13 (15:07 in Casablanca), THEO traded near $0.0061 in its main THEO/USDC pool on Base, GeckoTerminal data shows. Before the attack, by contrast, it sat around $0.081. Meanwhile, ether was at $2,509 on CoinGecko, down 1% in 24 hours.
What happened in the Autheo THEO exploit?
To begin with, THEO is the native coin of Autheo’s own chain. On Base, however, it exists as a bridged copy. In a healthy setup, each THEO on Base should match a THEO locked on Autheo Mainnet.
That link broke. First, the attacker delivered a cross-chain message that minted 19,000,000 THEO on Base with nothing locked on the other side, Crypto Times reported, citing the Defimon Alerts feed run by security firm Decurity. Next, an address pulled 9.5 million of the new tokens. After that, it pushed them through about 54 swaps across THEO pools on Base.
Altogether, those sales pulled out about $700,000 in WETH, USDC and cbBTC. In total, Defimon put the loss at about $1.7 million. Crypto.news and Crypto Briefing carried the same 19 million and 700.8 ETH figures.
Soon after, Autheo posted an urgent notice on X at 21:14 UTC on Oct. 12. It told holders not to buy, sell or bridge THEO until an official all-clear. As a result, MEXC also paused THEO deposits and withdrawals on Oct. 13 at the team’s request.
How one relayer key broke the bridge
The key detail is the security module. Hyperlane lets each token route choose how incoming messages are checked. According to Defimon, THEO’s Base contract used a “trusted relayer” module.
In other words, that module lets one relayer address approve any message. Because of this, there are no validator signatures and no second check. Notably, Hyperlane’s own production guide says new routes start with this module by default for testing. It also tells teams to remove it before launch.
Therefore, the likely problem sits in the deployment, not in Hyperlane’s core design. Even so, Autheo has not published a postmortem yet. It is also still unclear whether the key was stolen, misconfigured or used by someone with access.
Why the Autheo THEO exploit matters beyond one token
First, the loss is small, but the pattern is not. Indeed, a single point of approval keeps showing up in bridge hacks. Kelp DAO lost about $292 million in April after a forged message passed a setup that relied on one verifier, Crypto Times noted. Similarly, Humanity Protocol lost more than $36 million in June through compromised Hyperlane bridge admin keys, crypto.news reported.
Second, unbacked mints hurt holders more than the headline loss suggests. The attacker only extracted what thin pools could pay. However, every honest holder now owns a token diluted by supply that should not exist. In fact, the main THEO/USDC pool held only about $46,700 in liquidity on Oct. 13.
Third, there are reports of an even larger mint. Researcher Vlad claimed about 119 million THEO were created, roughly 70% of supply. Separately, an X user said the attacker sent him 93.5 million THEO and offered to return them. However, Autheo has confirmed neither claim. We saw a similar “tokens from nothing” risk in the XRP Ledger overflow bug report, although that flaw was fixed before anyone used it.
Data and context: Autheo at a glance
| Item | Detail |
|---|---|
| Unbacked THEO minted on Base | 19,000,000 (PeckShield) |
| ETH taken | 700.8 ETH, about $1.76M |
| Price before / after | ~$0.081 / ~$0.0061 (GeckoTerminal) |
| Autheo mainnet launch | May 14, 2026 |
| THEO on Base since | Aug. 20, 2026 (Hydrex) |
| MEXC listing | Oct. 1, 2026 |
For context, Autheo calls itself a Layer-0 operating system with its own Layer-1 chain. Its bridge documentation confirms THEO moves between Autheo Mainnet, Base and Robinhood Chain over Hyperlane Warp Routes.
What to watch next
- A postmortem. Autheo needs to explain how the relayer approved the mint, and whether the Robinhood Chain route is safe.
- A fix for fake supply. For example, the team may have to migrate the token or snapshot honest balances. Either way, the details will decide what Base holders keep.
- Returned tokens. If the 93.5 million THEO come back, then the dilution could shrink.
- Recovery scams. Autheo warned about fake support accounts. Fraudsters often target victims with “refund” offers, as in the Safe Wallet clone site case and the Coldcard phishing post.
Finally, other Hyperlane-based teams will likely audit their modules this week. So if you hold bridged tokens, it is worth asking which security setup your bridge uses.
Autheo THEO exploit FAQ
How much was stolen in the Autheo THEO exploit?
PeckShield said the attacker swapped 19 million unbacked THEO for 700.8 ETH, about $1.76 million, on Oct. 12, 2026. Defimon Alerts estimated total losses at about $1.7 million. Autheo has not confirmed a final figure.
Is THEO safe to trade right now?
Autheo has told holders not to buy, sell or bridge THEO until it issues an official all-clear. MEXC paused THEO deposits and withdrawals on Oct. 13, 2026, at the team’s request.
Was Hyperlane hacked?
So far, there is no sign that Hyperlane’s core protocol was breached. Reports point to THEO’s Base contract using a single trusted relayer module, which Hyperlane’s guide says should be removed before production. Autheo has not yet confirmed the root cause.
This article is for information only. It is not financial advice. Always do your own research (DYOR).
Sources
- Crypto Times: Autheo THEO crashes over 90% after $1.7M Hyperlane bridge exploit on Base (Oct. 13, 2026)
- crypto.news: Autheo THEO token plunges 92% after suspected bridge exploit (Oct. 13, 2026)
- Crypto Briefing: Autheo’s THEO plunges 92% after suspected bridge exploit on Base
- CoinDesk: Crypto Markets Today (Oct. 13, 2026)
- Hyperlane docs: Remove the trusted relayer ISM before production
- Autheo docs: Bridge overview
- GeckoTerminal: THEO/USDC pool on Base
- CoinGecko: Ethereum price
