Autheo Attacker Swaps 19 Million THEO for 700.8 Crypto in Bridge Exploit

19 Million THEO Became 700.8 ETH

The attack on Autheo's THEO token ran its course inside a 24-hour window that closed on October 12, and it ended with the token down 92% and an attacker holding funds in Ethereum (ETH). Autheo, the project behind the altcoin, posted a security notice on X on Monday confirming that its development team was investigating the incident and warning holders not to buy, sell, or bridge THEO until an official all-clear. The notice did not disclose the breach's full extent, name the vulnerability, or estimate losses. On-chain forensics filled part of that gap: blockchain security firm PeckShield identified a transaction in which 19 million newly minted THEO on Base, a Layer 2 network, were swapped for 700.8 ETH worth about $1.76 million, after which the proceeds were bridged to the Ethereum network. That swap is the clearest on-chain measure of what the attacker actually extracted, and the dollar figure depends on prices at the moment of conversion. A separate account of the incident put the unauthorized mint far higher. Researcher Vlad reported on X that roughly 119 million THEO, close to 70% of the token's supply, had been created through what he described as a cross-chain bridge exploit on Hyperlane infrastructure and then sold into the liquidity pools that would absorb them. Autheo has confirmed neither figure. The public record also does not establish whether the 19 million tranche PeckShield flagged and the 119 million mint belong to the same sequence, and the project has not confirmed Hyperlane as the vulnerability's source or explained how unauthorized minting became possible. Market data reviewed by the security firm showed THEO shedding about 92% of its value across the same 24 hours, a fall that tracked the selling in real time as each dump into shallow pools pressed the price lower.

93.5 Million THEO Landed in a Stranger's Wallet

A postscript surfaced as researchers combed the transaction history afterward. A verified X user going by Zynex said on X that an address tied to the attacker had transferred 93.5 million THEO to his wallet without any prior involvement. He stated that he had not moved, sold, or exchanged the tokens, sharing a transaction link pointing to BaseScan and a portfolio screenshot valuing the wallet above $1 million. That on-screen figure says little about realizable value after a collapse of this size, since it prices holdings at market rates that may not survive an attempted sale. Autheo has not confirmed whether the tokens belong to the project, and it has published no recovery address. The same class of public explorers is what lets outsiders read the Ethereum blockchain and its rollups. Alongside the investigation, Autheo broadened its advisory: holders were told to avoid suspicious smart contracts and links, especially those promising recovery services or compensation, and never to share private keys or seed phrases, with the team cautioning that impersonators would try to profit from the confusion. It directed users needing transaction assistance to a support address and said verified updates would appear only through its official channels. No recovery timeline, compensation arrangement, or date for resuming normal token activity was provided. The incident fits a pattern this year in which bridge infrastructure failed in ways that created unbacked tokens. In August, The Sandbox saw unauthorized SAND minted on Base and BNB Smart Chain through manipulated delegate permissions, an event the project said touched less than 0.01% of supply even as researchers counted far larger nominal value. In July, trading protocol AFX lost approximately $24.15 million in USDC through its cross-chain bridge, with investigators tracing the funds to Ethereum and their conversion into ETH. In June, Humanity Protocol traced losses exceeding $36 million to compromised administrative keys on its Hyperlane contracts after an employee's laptop was breached.

Minted Supply Is Not Stolen Value

The gap between what was minted and what was taken is the decisive fact. The on-chain record supports 19 million THEO minted on Base and 700.8 ETH, about $1.76 million, bridged to Ethereum; the 119 million and 93.5 million figures remain claims awaiting a confirmed post-mortem. Unauthorized tokens are worth only what liquidity lets an attacker redeem, which is why a nominal 70% supply inflation produced a seven-figure haul. Depth matters at every scale: Ethereum (ETH) liquidity on Binance recently touched a seven-month low, a measure of how tightly order books constrain extraction. Until Autheo confirms a root cause for the suspected Hyperlane flaw, the exploit is proven but the mechanism is not; holders should DYOR against official updates alone, and as of Tuesday no all-clear had come.