Autheo THEO unbacked mint (Base) hack — October 2026

An attacker minted 19 million unbacked THEO, the token of the Autheo network, on Base on 12 October 2026 and sold them into the token's liquidity pools for about 700.8 ETH, roughly $1.76 million. THEO on Base is a Hyperlane warp-route token: new tokens are minted when a cross-chain message arrives. According to Defimon Alerts, the route's security module trusted a single relayer to approve incoming messages, and a message from another chain minted the 19 million THEO with no matching lock on the origin chain.

The mint was recorded at about 17:06 UTC. At 17:16 UTC one transaction, read by this registry, sold 9.5 million of the new tokens into the THEO/USDC pair, took 476,900 USDC out of it, and converted the proceeds into 189.44 WETH for the attacker. Further sales followed over the next hours. PeckShield reported that the attacker had swapped the tokens for 700.8 ETH, worth about $1.76 million, and bridged the ETH to Ethereum. At an ETH price of about $2,510 at the time, that is consistent with the figure recorded here. Defimon's estimate of about $1.7 million is kept as the lower end. THEO fell about 92% within a day. On 15 October the attacker's address on Ethereum held 686.2 ETH, read by this registry.

Autheo acknowledged a security incident at 21:15 UTC on 12 October. It told holders not to buy, sell or bridge THEO until an all-clear, and warned against unsolicited recovery offers. It has not said how the mint was authorised, and in particular whether the relayer's key was compromised or the route was misconfigured. Some outlets reported 100 million or more THEO minted; the 19 million figure is the one PeckShield and Defimon read from the minting transaction. The loss fell on the liquidity providers in THEO's pools, whose USDC and ETH were taken in exchange for worthless tokens. Nothing has been recovered.