Autheo THEO Unbacked Cross-Chain Mint

On October 12, 2026, Autheo, the project behind the THEO utility token, was hit by a suspected bridge exploit on Base that let an attacker mint unbacked tokens and dump them for approximately $1.76 million in ETH, sending THEO down about 92% within a day.

What happened

THEO is issued on Base as a HypERC20 cross-chain token, meaning its supply on Base is supposed to be backed one-for-one by tokens locked on the origin chain and released only when a validated cross-chain message arrives. According to on-chain monitor Defimon Alerts, the attacker instead performed an "unbacked cross-chain mint": BaseScan logged the minting of 19 million THEO at 1:06 p.m. ET through a call to the process function on the token's cross-chain mailbox, with no matching lock on the origin chain.

Defimon identified the route's security module as TrustedRelayerIsm, a configuration that accepts a message as valid when it is approved by a single trusted relayer rather than a quorum of validators. Reporting indicates the attacker was able to push the mint message through that single-relayer trust path, though Autheo has not confirmed exactly how the mint was authorized. The attacker then dumped the freshly minted supply into the shallow Hydrex Integral THEO/USDC pool on Base — roughly 9.5 million THEO were sold in one transaction for about 189 ETH — and, per PeckShield, the proceeds totalling around 700.8 ETH (~$1.76 million) were bridged from Base to Ethereum mainnet. THEO fell from about $0.08 to roughly $0.006, a drop of about 92.4%.

Aftermath

Autheo acknowledged the incident the same day and told holders: "Do not buy, sell, or bridge THEO" until an official all-clear, warning users against suspicious links, unsolicited recovery offers, and sharing seed phrases. Exchange MEXC halted THEO transfers on October 13 while investigations continued. As of this writing no funds had been recovered, no attacker had been identified, and the figures remained provisional on-chain estimates; one researcher claimed a far larger mint of roughly 119 million THEO, but the 19 million figure is the one most sources share.

Why it matters

The incident is a textbook failure of a single-trusted-relayer cross-chain design: when a bridge mints wrapped supply on the strength of one approver, compromising or abusing that one path produces tokens with nothing behind them. It echoes the Qubit Finance bridge, where a deposit-validation gap let an attacker mint unbacked collateral, and the Wormhole exploit, where a signature-verification bypass minted 120,000 unbacked wETH. The trust-root weakness also recalls Nomad, whose flawed message verification turned any copied call into a valid withdrawal. As with the Gala Games unbacked mint, the damage landed not through stolen deposits but through counterfeit supply sold into thin liquidity before the market could react.