Autheo has halted block production on its mainnet and stopped an affected cross-chain relayer after an unauthorized THEO mint was followed by a sharp selloff that sent the token down roughly 92%.
Blockchain security monitor PeckShield reported that 19 million THEO were minted on Base and subsequently swapped for approximately 700.8 ETH, worth about $1.76 million at the time. The ETH was then bridged from Base to Ethereum mainnet.
Autheo has confirmed the underlying security incident but has not confirmed those exact figures. In an official community update, the project said it became aware on October 12 of an exploit involving the unauthorized minting of THEO by an unauthorized actor, followed by transfers to Base.
The company said it was still investigating the number of tokens affected, associated transfers and sales, the impact on trading liquidity and the wider financial consequences. That leaves an important distinction between what can be observed and estimated on-chain and what Autheo has formally established through its own investigation.
Autheo Took Its Mainnet and Cross-Chain Relayer Offline
Autheo’s response has gone considerably further than simply pausing THEO trading.
The company said it coordinated with infrastructure partners to halt block production on the Autheo Mainnet, take validator nodes offline and stop the affected cross-chain relayer. Those measures are intended to remain in place until identified vulnerabilities have been addressed and the network can be restored safely.
Autheo has also warned users not to buy, sell or bridge THEO while the investigation continues. MEXC, where THEO began trading earlier this month, has separately suspended deposits and withdrawals at the request of the Autheo project team.
THEO exists in two technically distinct forms. It is the native asset used on Autheo’s own Layer 1, while a bridged ERC-20 representation trades on Base. Autheo had previously described its Base bridge as using cross-chain infrastructure to move value between the two environments.
The project launched THEO trading on Hydrex on August 20 with a reference price of $0.05 and expanded the token to MEXC on October 1. The security incident therefore arrived less than two months after public Base trading began and less than two weeks after the centralized-exchange listing.
Security Researchers Point to the Bridge, but the Root Cause Is Not Confirmed
The strongest working theory centers on the cross-chain bridge infrastructure.
Independent security analysis has described the 19 million THEO as an unbacked cross-chain mint and pointed to a trusted-relayer component in the route responsible for accepting cross-chain messages. Under that interpretation, a message accepted by the bridge caused THEO to be created on Base without the corresponding legitimate backing expected on the originating side.
But Autheo has not yet published a technical postmortem confirming that mechanism.
That distinction matters because several very different failures could ultimately produce an unauthorized mint. A relayer credential could have been compromised. A message-validation configuration could have been too permissive. A privileged component could have been misused. Or a flaw elsewhere in the bridge or token contracts could have allowed an invalid message to pass.
Dave Finances recently examined the same problem of separating observable on-chain consequences from an unresolved authorization mechanism when Payy shut down payments after a $1.83 million USDC bridge exploit. In that case, the assets moving on-chain were clear before investigators could establish exactly how the malicious transaction had passed the system’s expected controls.
Autheo is now in a similar position. The unauthorized supply and subsequent asset movements are visible, but the decisive security question is why the system accepted the action in the first place.
An Unauthorized Mint Is More Dangerous Than an Ordinary Token Theft
The economic mechanics make this incident particularly damaging for THEO holders.
When an attacker steals existing tokens, ownership changes but the total supply does not necessarily increase. An unauthorized mint is different: new assets can be created without the economic event that is supposed to justify their existence.
If those tokens are immediately sold into decentralized-exchange liquidity, the attacker is effectively exchanging newly created supply for assets that were already economically real — ETH, USDC or other collateral provided by existing market participants.
That combination can hit holders twice. Liquidity is extracted from the market while the token supply is simultaneously diluted.
The result helps explain why THEO’s market reaction was so violent. Security monitoring put the decline at roughly 92% over 24 hours as the newly created tokens were sold and uncertainty spread over which supply should be considered legitimate.
The mechanism differs from the BitBay StableVault exploit, where a contract-level accounting flaw reportedly allowed an attacker to withdraw assets through an abnormal zero-liquidity state. Autheo’s unanswered question appears to sit closer to authorization and cross-chain message integrity than ordinary vault accounting.
The Mainnet Halt Makes This Bigger Than a $1.76 Million Token Dump
The reported $1.76 million in ETH is the easiest number to put in the headline, but it may not be the most important one.
Autheo stopped block production on its own network.
That means the response extends beyond traders who bought THEO on Base. Validators, applications and users relying on the Autheo mainnet now depend on the project proving that the vulnerable path has been contained before normal network activity resumes.
This is where bridge exploits become infrastructure events rather than isolated token thefts. A bridge establishes an economic relationship between assets on separate chains. If one side can create claims that the other side never legitimately authorized, the system has to determine which supply is canonical before simply turning everything back on.
Restarting too quickly could preserve the vulnerability or create further uncertainty around token balances. Waiting for complete certainty, meanwhile, extends the operational disruption.
The Biggest Question Is Who or What Had Minting Authority
For investors, the technical postmortem matters more than whether THEO rebounds from the initial 92% collapse.
If investigators determine that one compromised relayer credential was sufficient to authorize a cross-chain mint, the incident becomes a lesson in concentrated infrastructure privilege. In that scenario, the smart contracts may have executed exactly as designed after receiving what they considered a valid message — meaning the real security boundary was the credential controlling that message.
That would resemble the problem highlighted by the suspected $12.5 million 79Vault exploit, where the central question was not simply what tokens moved but how privileged infrastructure obtained authority to move them.
If, instead, Autheo identifies a flaw in message verification or bridge-contract logic, the remediation requirements change. The team would need to demonstrate that the specific invalid state transition can no longer be reproduced, potentially alongside contract upgrades, additional validation layers or stricter minting limits.
Those distinctions are not technical trivia. They determine whether the failure was an isolated compromised secret, an architectural single point of failure or a reusable software vulnerability.
A Price Recovery Would Not Resolve the Security Question
THEO could recover some of the 92% decline once panic selling fades. That would not mean the incident had been resolved.
The more meaningful milestones are operational: identifying the root cause, reconciling legitimate and unauthorized supply, explaining what happened to liquidity providers, restoring the mainnet safely and demonstrating what prevents another unauthorized mint.
Autheo also needs to clarify the final scale. Security monitors have reported 19 million newly minted THEO and about 700.8 ETH in proceeds, while other public claims have circulated with substantially different token figures. Autheo itself has explicitly said the number of affected tokens and full financial impact remain under investigation.
That makes restraint important until the postmortem arrives.
What is already established is serious enough. An unauthorized actor was able to create THEO, value was extracted through cross-chain markets, the token lost most of its market value, exchange transfers were suspended and Autheo took the extraordinary step of stopping its own blockchain while investigators work out what failed.
The next update needs to do more than announce that the network is running again. Investors need to know exactly which trust assumption broke — and why the replacement architecture should be trusted not to break in the same way.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574