Autheo halted block production and took validator nodes offline after discovering unauthorized THEO issuance connected to its cross-chain infrastructure on October 12. The project’s response extended beyond the Base token market, with Autheo also disabling the affected cross-chain relayer while investigating the source of the unauthorized activity.
In its official community update, Autheo said unauthorized THEO tokens were created and subsequently transferred to Base, but it has not confirmed the final number of affected tokens or the financial impact. The project also has not established publicly whether the failure originated from compromised credentials, incorrect bridge authorization or another component of its cross-chain infrastructure.
The disruption produced an immediate market reaction. THEO traded near $0.081 before the incident and closed around $0.006 on October 12, representing a decline of more than 90%. The token’s collapse followed unauthorized supply entering its Base liquidity rather than a comparable reduction in the value of Autheo’s underlying network assets.
Onchain Records Show 119 Million THEO Minted
Early monitoring from PeckShield identified a 19 million THEO mint, but subsequent transaction analysis uncovered another 100 million-token issuance to the same address roughly 38 minutes later. The two Base transactions therefore show 119 million THEO created through the destination-side bridge contract, although that figure should not be treated as Autheo’s confirmed incident-wide total.
The distinction becomes even more important when measuring the financial loss. An independent reconstruction found that the first 19 million THEO were sold for approximately 280.7 ETH, while about 6.49 million tokens from the second mint generated another 11.04 ETH after the price had collapsed. The identified sales produced roughly 291.7 ETH, not the widely reported 700.8 ETH.
Approximately 93.51 million THEO from the second mint were subsequently transferred to another Base address rather than sold. The same analysis found that roughly 400.8 ETH already existed in the Ethereum wallet before the exploit, explaining why its post-bridge balance of around 700.8 ETH overstated incident proceeds. Unauthorized token creation, tokens sold and wallet balances are therefore three separate measurements.
Cross-Chain Authorization Remains Under Investigation
THEO on Base operates through cross-chain infrastructure in which destination-side tokens can be minted after an accepted message indicates corresponding activity on the originating network. Onchain analysis identified a Hyperlane-based route involving a trusted relayer, but the available evidence does not yet establish whether the relayer was compromised, accepted an unauthorized origin-side message or operated under a faulty configuration.
That unresolved security boundary makes the incident comparable to other bridge failures where headline mint amounts can differ substantially from realized losses. A Symbiosis exploit produced roughly 46 billion unauthorized syBTC, while only a fraction could be converted into legitimate liquidity. Similarly, the Nomic bridge incident created unbacked nBTC without implying that the full nominal value of the minted supply had been stolen.
Unauthorized issuance can also originate outside token-contract logic. A recent Grail.xyz incident involved privilege escalation and unauthorized gToken mints, demonstrating how compromised administrative infrastructure can cause contracts to issue economically invalid tokens while functioning as programmed.
For Autheo, that distinction remains unresolved. The confirmed response is that the network, validators and affected relayer were shut down while the team investigates, whereas the root cause, final unauthorized supply and net financial loss remain unconfirmed. Until Autheo publishes a technical postmortem and reconciled accounting, the 119 million observed Base mints and approximately 291.7 ETH in identified sale proceeds are best treated as separate onchain measurements rather than a final loss figure.