Attacker Mints 19 Million Unbacked THEO on Base Through Hyperlane Bridge, Token Crashes 92%

Published October 13, 2026, 6:40 PM PKT. Based on Autheo's official security notice on X (Oct. 12, 2026) and MEXC's deposit/withdrawal suspension notice (Oct. 13, 2026), plus on-chain alerts from PeckShield and Defimon Alerts, Hyperlane's protocol documentation, and reporting by CryptoTimes, weex and CoinDesk's AI desk.

An attacker minted 19 million unbacked THEO tokens on Base through Autheo's Hyperlane bridge on October 12, 2026, then dumped them into liquidity pools for about $1.76 million in ether. THEO, the native token of the Autheo blockchain, collapsed 92% within 24 hours, and Autheo told holders not to buy, sell, or bridge the token until it issues an official all-clear.

The loss estimate came from Defimon Alerts, a decentralized finance security monitoring feed automated by blockchain security firm Decurity, in an alert published at 08:07 UTC on October 13. Blockchain security firm PeckShield separately confirmed that the minted tokens were swapped for 700.8 ETH and bridged to the Ethereum mainnet.

The 19-million-token mint

The exploit centered on the bridge that moves THEO between Autheo's own chain and Base. On Base, THEO is a HypERC20 token, a synthetic version that the Hyperlane Warp Route bridge mints one-to-one when an equal amount of THEO is locked on Autheo's chain. In a healthy setup, every THEO on Base has a matching THEO locked at the origin. This time, there was no matching collateral.

According to Defimon Alerts, the attacker's Hyperlane message arrived from origin domain 2127, which matches Autheo's EVM chain identifier. The message hit the handle function on the THEO token contract on Base and minted 19,000,000 THEO from the zero address. No deposit ever happened on the other side.

How one relayer key opened the mint

The bridge's security rested on a single address. Defimon Alerts reported that THEO's Base contract used a TrustedRelayerIsm as its Interchain Security Module, the component Hyperlane uses to decide whether an incoming cross-chain message is valid. Hyperlane's own documentation says this module hands one relayer address permission to execute arbitrary messages, with no validator signatures or other multi-party checks required.

Hyperlane's production guide goes further: new Warp Routes deployed through its command line tool use the Trusted Relayer module by default so teams can test without running their own validators, and the same guide tells teams to remove the module before going to production. Whoever controlled the relayer key, whether an attacker who stole it, a misconfiguration, or an authorized party, could mint THEO on Base at will.

Autheo's August launch announcement had said that Avelar Labs audited the bridge between Base and Autheo Mainnet. As of October 13, Autheo had not released a technical postmortem and had not confirmed the full scope of losses.

54 swaps and 700 ether out the door

Once the tokens existed, the attacker moved fast. An orchestrator address beginning with 0x599b pulled 9.5 million of the newly minted tokens and routed them through roughly 54 swaps across the THEO/USDC pool, Uniswap v4 positions, and Hydrex pools on Base, according to Defimon Alerts. Hydrex, a decentralized exchange on Base, became THEO's first trading venue when the token launched on August 20, 2026.

Those sales extracted about $700,000 in Wrapped Ether, USD Coin and Coinbase Wrapped Bitcoin, and the full swap-and-bridge campaign netted the attacker 700.8 ETH, worth about $1.76 million, which PeckShield said was bridged to Ethereum. The token price did what prices do when 19 million surprise tokens hit shallow pools: THEO fell more than 90% within 24 hours, bottoming near $0.006262, according to CoinDesk's AI desk.

Autheo's no-touch order and MEXC's freeze

Autheo posted an urgent security notice on X at 21:14 UTC on October 12. The team said it was investigating an incident involving THEO and told users not to buy, sell, or bridge the token until an official all-clear. The notice pointed holders to support@autheo.com for transaction help and warned about impersonators and unsolicited fund-recovery offers, a common follow-up scam after exploits.

On October 13, centralized exchange MEXC suspended THEO deposits and withdrawals at the Autheo team's request. The timing stung: MEXC had only listed THEO on October 1, less than two weeks before the exploit.

A 93.5-million-token offer to give it back

In a strange turn, a wallet holder reported receiving 93.5 million THEO from the alleged attacker and offered to return the tokens to Autheo, according to reporting by weex. That figure is far larger than PeckShield's confirmed 19-million mint, and a separate researcher alleged the attacker may have minted as many as 119 million THEO through the same Hyperlane setup. Autheo has verified neither figure.

The incident is an awkward bookend to the project's own recent writing. On October 8, four days before the attack, Autheo published a blog post analyzing the NEAR Intents exploit, stressing that teams must scrutinize the handoffs between deposit infrastructure and smart contracts. The Hyperlane bridge that was supposed to be one of those carefully scrutinized handoffs became the attack vector instead.

Until Autheo publishes its postmortem, the core questions are open: how the relayer key fell into the wrong hands, how many tokens were actually minted, and whether any of the $1.76 million can be recovered.

This article is news reporting and is not investment advice.

Sources

• Autheo, urgent security notice on X (Oct. 12, 2026), primary source for the incident confirmation, the instruction not to buy, sell, or bridge THEO until an all-clear, the support contact, and the impersonator warning
• MEXC, THEO deposit and withdrawal suspension notice (Oct. 13, 2026), primary source for the trading halt, issued at the Autheo team's request; THEO was listed on MEXC on October 1, 2026
• PeckShield, PeckShieldAlert on X (Oct. 13, 2026), secondary on-chain source for the 19-million THEO mint, the swap into 700.8 ETH (~$1.76 million), the bridge to Ethereum, and the 92% 24-hour price drop
• Defimon Alerts (Decurity), security alert published 08:07 UTC (Oct. 13, 2026), secondary source for the $1.7 million loss estimate, the TrustedRelayerIsm setup, the origin domain 2127 message, the 0x599b orchestrator address, the ~54 swaps, and the $700,000 extracted through THEO/USDC, Uniswap v4 and Hydrex pools
• Hyperlane documentation, secondary source for the TrustedRelayerIsm's single-relayer authority, the no-validator-signatures design, and the production-guide instruction to remove the module before production
• The Crypto Times, Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base (Oct. 13, 2026), secondary source for the transaction details, the 21:14 UTC Autheo notice, the Avelar Labs audit claim, the October 8 NEAR Intents blog post, and the Kelp DAO comparison
• weex, Autheo THEO Token Plunges 92% After Suspected Bridge Exploit (Oct. 13, 2026), secondary source for the wallet holder's claim of receiving 93.5 million THEO from the alleged attacker and the offer to return the tokens