THEO token exploit has triggered a massive price drop. Autheo’s THEO token plunged more than 90%. The suspected cause is a cross-chain bridge exploit.
The attacker reportedly minted millions of unauthorized tokens on Base. Autheo confirmed the incident on October 13. The team warned holders against buying, selling, or bridging THEO.
Why the THEO token exploit matters
Autheo did not disclose the full breach extent. It did not identify the vulnerability. It also did not estimate financial losses. However, blockchain security firm PeckShield reported key details.
PeckShield said 19 million THEO tokens were minted on Base. The attacker exchanged them for 700.8 ETH. That was worth approximately $1.76 million. The proceeds were then transferred to Ethereum. Consequently, THEO fell 92% over 24 hours.
THEO token exploit reportedly involved unauthorized minting
Initial reports pointed to a possible Hyperlane bridge vulnerability. Crypto researcher Vlad claimed the attacker minted 119 million THEO. He said that equaled roughly 70% of the token’s supply. The attacker then sold tokens into liquidity pools. This contributed to the price collapse.
PeckShield identified a separate transaction with 19 million newly minted THEO. Those tokens were exchanged for ETH. The proceeds were bridged to Ethereum. The 19 million figure is smaller than Vlad’s 119 million. Neither figure has been confirmed by Autheo. It is unclear if both transactions are part of the same sequence.
The project has not confirmed Hyperlane as the vulnerability source. It also has not explained how unauthorized minting occurred. Meanwhile, the reported sales left THEO trading far below its previous price. PeckShield data showed a 92% decline within a day.
The amount of tokens created is not the financial loss. The attacker’s actual gain depends on available liquidity.
Hacker reportedly sent 93.5 million THEO to an unrelated wallet
An unusual transfer of 93.5 million THEO emerged during the investigation. A verified X user named Zynex claimed the attacker sent tokens to his wallet. He had no prior involvement.
“A hacker just sent 93.5M $THEO from the @Autheo_Network exploit to my wallet,” he wrote. Zynex said he did not move, sell, or exchange the tokens. “Not mine. Didn’t touch it. Not selling, not swapping, not moving,” he stated.
He publicly requested an official return address from Autheo. He offered to transfer the full amount back. A transaction link pointed to BaseScan. A portfolio screenshot showed a valuation exceeding $1 million. However, that valuation does not establish how much the tokens could actually be sold for. The price collapsed and liquidity is disrupted.
The recipient’s account has not been independently verified. Autheo has not confirmed whether the tokens belong to the project. It also has not provided a recovery address.
Autheo warns users against trading THEO during investigation
Autheo instructed holders to stop all buying, selling, and bridging. This warning remains until the team issues an official clearance. The warning also covered suspicious contracts and links. Specifically, those claiming to offer recovery services.
Autheo cautioned holders against sharing private keys or seed phrases. It warned that impersonators could exploit confusion. The project directed users to support@autheo.com. It said verified updates would come only through official channels. No recovery timeline or compensation arrangement was provided.
What comes next for the THEO token exploit
Autheo has not provided a recovery timeline. It has not confirmed a date for resuming normal activity. The investigation continues. Therefore, holders should avoid trading THEO. They should also avoid suspicious links. They should never share private keys or seed phrases.
