Autheo Network's native THEO token crashed more than 90% within 24 hours after a suspected cross-chain exploit allowed an attacker to mint tokens on Base without authorization and extract roughly $1.76 million in Ether.

Blockchain security firm PeckShield reported that 19 million THEO were minted on Base, swapped for 700.8 ETH — approximately $1.76 million at the time — and then bridged from Base to the Ethereum mainnet, a move that makes the funds harder to track. The findings were confirmed in scope by multiple outlets tracking the incident, and THEO fell as much as 92% from its pre-incident level.

What the on-chain record shows

The sequence reconstructed from PeckShield's alerting and subsequent reporting:

  • Unauthorized mint: 19 million THEO were created on Base, the Coinbase-backed Ethereum layer-2, exceeding any legitimate issuance the project had scheduled.
  • Swap: The minted THEO was exchanged for 700.8 ETH through on-chain liquidity — not a flash loan or price-oracle manipulation, but fresh supply sold into existing pools.
  • Bridge-out: The ETH proceeds were moved from Base to Ethereum mainnet, severing the easiest tracing path.

The Crypto Times reported that the suspected exploit vector involves the bridge infrastructure connecting Autheo's chains — reporting that points to the Hyperlane messaging layer used for cross-chain transfers — and that Autheo launched an investigation and warned users after detecting the activity. The project has not yet published a full technical post-mortem, and the precise contract-level flaw has not been independently confirmed.

The pattern: mint authority is the crown jewel

Whatever the final root-cause analysis shows, the incident fits the year's dominant bridge-compromise pattern: an attacker who controls, or can spoof, the message flow that authorizes token issuance on a destination chain does not need to break the token itself. They mint at will and sell into whatever liquidity exists.

For a token with a market cap small enough that a 19-million-token dump collapses the price 92%, the damage is twofold — the direct $1.76 million extraction and the effective destruction of the token's value for holders who did nothing wrong. Bridge mints also carry a contagion risk that simple theft does not: if the same messaging vulnerability exists elsewhere in a protocol's deployment, the same attack can be replayed.

Autheo has not stated whether the stolen ETH has been frozen or traced to any exchange. The attacker's identity is unknown, and attribution remains open.

TrustGrade's recent bridge and protocol coverage: NEAR Intents' $3.8M exploit and full return and the Zano rollback after a gateway address exploit.

TrustGrade tracks the security posture of platforms and protocols in digital assets. Verified trust data: trustgrade.ai.