Unauthorized THEO minted on Base sold for 700.8 ETH and sank the token 92% in a day
An attacker minted 19 million unauthorized THEO on Base and swapped it for 700.8 ETH, about $1.76 million, as the token fell 92%. Autheo has not named a root cause, so the case that a bridge minting right failed is still a suspicion.
The Investor · Invest desk
Three figures: PeckShield reported 19 million THEO minted on Base and swapped for ETH; researcher Vlad claimed about 119 million THEO minted, which Autheo has not confirmed; Zynex said an attacker-associated address sent 93.5 million THEO to his wallet, not independently verified.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Minted on Base and swapped for ETH, per PeckShield | 19 million THEO | 1 | |
| Minted, approximately, per researcher Vlad | 119 million THEO | Autheo has not confirmed the figure | 10 |
| Sent to his wallet by attacker-linked address, per Zynex | 93.5 million THEO | not independently verified | 16 |
What happened
- THEO traded at about $0.08 before the incident and at around $0.006 within a day, Cryptobriefing reported.
- Researcher Vlad claimed the attacker minted about 119 million THEO through a suspected Hyperlane vulnerability, a figure Autheo has not confirmed.
- A holder posting as Zynex said an attacker-linked address sent 93.5 million THEO to his wallet unprompted, and he offered to return the tokens to Autheo.
- In an October 13 notice Autheo said it was investigating and told holders not to buy, sell or bridge THEO, without disclosing the vulnerability or a loss estimate.
Why it matters
- Who's exposed exposure The ETH the attacker received had to come from whoever sat on the other side of those swaps, so pool providers lost cash while holders lost value on every token they kept.
- What doesn't add up contradiction PeckShield's 19 million, Vlad's 119 million and Zynex's 93.5 million do not fit one count, so the overhang of unauthorized tokens and any remediation bill cannot be sized yet.
- Who has to decide decision Autheo has to choose between contract upgrades, migrations or another fix for any unauthorized tokens left on Base, and teams on similar Hyperlane setups have cause to check their configurations meanwhile.
Next story · Invest · yesterday
Toronto police lay 82 charges over a kidnapping aimed at a man's crypto and security systemsConfirmed6 publishers
Divide the $1.76 million of proceeds by the 19 million tokens PeckShield counted and the attacker averaged about $0.093 a token [21]. At the $0.08 pre-incident quote [2], those tokens were worth $1.52 million, so the sale cleared about $240,000 above the quoted price [22] into pools Cryptobriefing described as thin [5]. A forced seller in thin pools should sell below the quote. Either the quote is rounded, or the 19 million is only part of what was sold, or the fills came in tranches before the slide.
The mint count has a larger gap. Vlad's 119 million is 100 million tokens above PeckShield's 19 million [13], and crypto.news noted that the available statements do not establish whether the two describe the same transactions [11]. The 93.5 million THEO that Zynex says landed in his wallet is 4.9 times PeckShield's figure [23]. If those tokens were minted in this event, 19 million is the slice that was sold and not the whole mint.
Vlad's description of 119 million as roughly 70% of supply [10] also sits badly with the token's design. With a 7 billion maximum and about 5.3% circulating at launch [9], 119 million is about 32% of the launch float and 1.7% of the cap [12].
Zynex, who offered to return the tokens, said: "Not mine. Didn't touch it. Not selling, not swapping, not moving," [17]. A screenshot he posted valued the wallet's holdings above $1 million [18]. At $0.006 a token, the 93.5 million THEO alone would be worth about $561,000 [24], so the gap is either other holdings or a stale price.
On the thesis that bridge minting rights are a single point of failure, we think the evidence supports a narrower claim. THEO on Base is a bridged token on a Hyperlane-based route that also links Autheo's mainnet and Robinhood Chain [7], and whatever failed let one party create tokens the market then absorbed. Liquidity limited the take: crypto.news wrote that the value an attacker can obtain from unauthorized tokens depends on the liquidity available to exchange them [6], and here that came to $1.76 million [1].
If the suspicion holds, the single point of failure is the minting permission. The counter-thesis is that the fault sits in Autheo's own deployment. Autheo has not confirmed Hyperlane as the source [15], and Cryptobriefing says the exact root cause is unconfirmed [14]. A root-cause report naming a misconfigured Autheo contract or a compromised Autheo key would end the bridge argument for this case.
Halborn, CertiK and Avelar Labs audited Autheo [8]; the sources do not say what the audits covered.
What to watch
- Autheo's root-cause report: a finding in Hyperlane's contracts would extend the risk to other Hyperlane-connected tokens, while a fault in Autheo's own deployment or keys would confine it.
- Whether Autheo publishes a return address for the 93.5 million THEO Zynex holds and says how many unauthorized tokens remain on Base.
- Whether Autheo or PeckShield confirms the 19 million or the 119 million mint figure, which sets the size of any remediation.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
PeckShield reported that 19 million THEO tokens were minted on Base and exchanged for 700.8 ETH, worth approximately $1.76 million, with the proceeds transferred to Ethereum.
- [2]
THEO traded at approximately $0.08 before the incident and within a day had fallen to around $0.006.
- [3]
PeckShield said THEO had fallen 92% over 24 hours following the incident.
- [4]
In an October 13 security notice Autheo said its development team was investigating an incident involving THEO and warned holders against buying, selling or bridging the token; the project did not disclose the full extent of the breach, identify the vulnerability or estimate financial losses.
- [5]
Base-based trading venues such as Hydrex had thin liquidity for THEO, which greatly amplified the sell pressure on the token.
- [6]
The value an attacker can obtain from unauthorized tokens depends on the liquidity available to exchange them for other assets, so the amount of tokens created should not be treated as the financial loss.
- [7]
Autheo uses a Hyperlane-based bridge to move THEO tokens between its own mainnet, Base and Robinhood Chain.
- [8]
Autheo has undergone security audits by Halborn, CertiK and Avelar Labs.
- [9]
THEO has a maximum supply of 7 billion tokens, with approximately 5.3% circulating at launch.
- [10]
Crypto researcher Vlad claimed the attacker minted approximately 119 million THEO through a suspected Hyperlane bridge vulnerability, which he described as roughly 70% of the token's supply; Autheo has not confirmed the figure.
- [11]
Autheo has not confirmed either the 19 million or the 119 million figure, and the available statements do not establish whether the transactions were part of the same sequence.
- [12]
119 million THEO is about 32% of the launch circulating float (about 371 million) and about 1.7% of the 7 billion maximum supply.
- [13]
Vlad's 119 million figure is 100 million tokens above PeckShield's 19 million.
- [14]
The exact root cause has not been confirmed; the incident is described as a suspected bridge exploit and Autheo's investigation is ongoing.
- [15]
Autheo has not confirmed that Hyperlane was the source of the vulnerability or explained how unauthorized minting became possible.
- [16]
Zynex, a verified X user, said an address associated with the attacker sent 93.5 million THEO to his wallet without prior involvement, and he offered to return the tokens to Autheo.
- [17]
Zynex said: "Not mine. Didn't touch it. Not selling, not swapping, not moving,"
- [18]
A portfolio screenshot shared by Zynex displayed a valuation exceeding $1 million for the wallet's holdings; the recipient's account of the transfer has not been independently verified.
- [19]
If 19 million unauthorized tokens remain in circulation on Base, Autheo will need to explain how it plans to account for them, whether through contract upgrades, migrations or other remediation.
- [20]
Hyperlane-connected projects will be watching for the root cause, and other teams relying on similar setups have reason to double-check their configurations.
- [21]
The implied average sale price is about $0.093 per THEO.
- [22]
19 million THEO at $0.08 is $1.52 million; the $1.76 million proceeds exceed that by about $240,000.
- [23]
The 93.5 million THEO Zynex received is about 4.9 times PeckShield's 19 million.
- [24]
93.5 million THEO at $0.006 is about $561,000.
Sources
2 independent publishers whose own reporting we read for this story.
- crypto.newsAutheo THEO token plunges 92% after suspected bridge exploit
1 article · October 13, 2026
- cryptobriefing.comAutheo’s THEO plunges 92% after suspected bridge exploit on Base
1 article · October 13, 2026
Topics and entities
Topics
- Cross-Chain Bridge Security
- Crypto protocol exploits