Autheo THEO exploit: two unbacked mints, 119 million tokens, and about 292 ETH taken — not 700

THEO is the token of Autheo. On Base it exists as a Hyperlane bridge token (0xebe516a20238F79dc20b07ead6768e08891Ed309): it is minted on Base when a message arrives saying the same amount was locked on Autheo’s chain. Defimon Alerts pointed out that the route accepted messages through a TrustedRelayerIsm, a security module that trusts a single relayer, and called the 12 October mint an unbacked cross-chain mint. PeckShield reported 19 million THEO minted and swapped for 700.8 ETH, about $1.76 million. The price of THEO fell about 92% within a day, and Autheo told holders not to buy, sell or bridge the token.

Below is what the wallets show, read by us on 14 October 2026.

At 16:45 and 16:46 UTC the receiving address, 0x3048b4Ee5A070F33b73E3401829847255079E0AD, sent 250 and 25 THEO from Base back to Autheo’s chain, the normal way, to two other addresses. Twenty minutes later, at 17:06, the bridge contract on Base minted 19,000,000 THEO to it. At 17:45 it minted another 100,000,000 THEO to the same address. Both mints came from messages that named Autheo’s chain as the origin and were delivered by 0xeF305Ec5DF4054B15295A0389787bf671Ab930CE, the relayer that had delivered 378 messages to the Hyperlane mailbox on Base since 23 July and kept delivering ordinary ones after the attack.

The reports describe only the first mint. We cannot read Autheo’s chain from here, so we cannot say whether the two messages were forged at the relayer or emitted on the origin chain by mistake. On Base, both were accepted as real.

The first 19 million THEO were sold through the Hydrex router in four swaps between 17:16 and 17:17 UTC for 280.70 ETH. At 17:18 the address sent 280.45 ETH to the Relay bridge, and the same address on Ethereum received 278.52 ETH eight seconds later.

Of the second mint, only 6.49 million THEO were sold, between 17:47 and 17:50, for 11.04 ETH: the price had already collapsed. Those went over Relay too, 11.21 ETH arriving on Ethereum at 17:52. In total the THEO sales produced 291.7 ETH, about $730,000 at the price of the day. A further 0.1 ETH went from Base to Robinhood Chain.

After the bridges, the Ethereum wallet held 700.81 ETH. That is the number in the reports. But the wallet did not start empty. It received its first funds on 5 October: 414.4 ETH in one transfer from 0xf77331B2893B275A5C58F97723469837A25fa574, which emptied itself into it. That wallet in turn had received 281.4 ETH through the NEAR Intents bridge on 30 September and 174.6 ETH from another wallet on 5 October.

Between 5 and 12 October the new wallet sent about 77 ETH out through Relay, mostly in amounts of 3 to 9 ETH, and on the morning of 12 October it received another 68.4 ETH through NEAR Intents. Just before the attack it held 400.8 ETH. So most of the reported 700.8 ETH was not taken from THEO holders. It is money that had been on the wallet for a week, and it came from somewhere else. Where it came from before NEAR Intents we have not traced.

At 17:57 UTC the attacker sent 93,510,011 THEO, almost all of the second mint, to 0x690d7552375Fcd23Bd2a5E1d74f7445FAdfc6c83. They are still there. This wallet is not new: it has been in use on Base since September 2024, mostly for small swaps and bridge transfers. It has been topped up nine times from a Binance hot wallet and seven times from a MEXC hot wallet, which is what withdrawals from an exchange account look like. A minute before it received the 93.5 million, it bought 15,364 THEO in the pool itself. On 13 October it approved the THEO contract three times but did not sell.

Receiving tokens does not make a wallet’s owner the attacker: anyone can send anything to any address. But this transfer was made by the attacker, deliberately, with the part of the loot that could not be sold. Binance and MEXC can say who withdrew to this address.

On 14 October the attacker’s Ethereum wallet still held 686.23 ETH. At 05:32 UTC that day it sent 14.56 ETH to 0xc703C9bF559F8f9E2128F9366688f59D398af1e2, a wallet it had already paid 5.115 ETH on 5 October, its first day. Nothing has gone to a mixer so far.

Within minutes of each large transfer, strangers sent zero-value transactions and dust to this wallet from addresses that begin and end like its real counterparties. This is address poisoning. Anyone copying an address from its history should check every character.

We marked 2 addresses on Ethereum in our database as the attacker’s: the wallet that received the minted tokens and bridged the proceeds, and the wallet it paid on 5 and 14 October. Neither was marked before. We did not mark the wallet holding the 93.5 million THEO, the older wallet that funded the attacker on 5 October, the relayer, the bridges or the router: the chain links them to the attacker, but it does not show who controls them.

To check an address yourself, use the address check.

It does not say who the attacker is, how the two messages were produced, or that Autheo, Hyperlane, Relay, Hydrex, NEAR Intents, Binance or MEXC did anything unlawful. The mechanics are Defimon Alerts’; the 19 million mint and the 700.8 ETH figure were first reported by PeckShield. The second mint, the 291.7 ETH the sales actually produced, the 400 ETH that were on the wallet before, and the wallet that received the unsold tokens are ours, read on 14 October 2026.