Autheo Exploit Reassessment Finds 119M THEO Minted but Only $730K in ETH Sales

Blockchain investigation platform PublicAML published its transaction-level findings on October 14, reconstructing two unauthorized mints, seven token swaps, cross-chain transfers and the movement of more than 93.5 million unsold THEO.

The findings substantially change the interpretation of the October 12 incident. Although the number of tokens identified in the unauthorized minting activity is more than six times the initial 19 million figure highlighted by PeckShield, the amount of ETH generated through token sales appears considerably smaller than early estimates suggested.

Crucially, PublicAML found that approximately 400 ETH had already been present in the receiving Ethereum wallet before the exploit. That existing balance was included in the 700.8 ETH figure widely reported as proceeds from the attack.

The investigation provides a clearer account of the transactions but does not establish who controlled every receiving wallet or how the unauthorized minting messages originated.

Two Unauthorized Mints Created 119 Million THEO on Base

The October 12 attack involved two separate token-minting events received by the same address on Base, according to PublicAML’s October 14 on-chain investigation.

The first occurred at 17:06 UTC, when 19 million THEO were minted through the project’s Hyperlane-based cross-chain bridge infrastructure.

A second transaction followed at 17:45 UTC, creating another 100 million THEO. The two events were separated by just 39 minutes.

Both minting messages identified Autheo’s native chain as their origin and were delivered through the same relayer address. PublicAML found that this relayer had processed hundreds of messages before the incident and continued handling ordinary messages afterward.

The analysis establishes that the two minting transactions occurred, but it does not determine whether the messages were forged, improperly authorized or incorrectly generated on the originating blockchain.

Autheo confirmed the underlying security incident on October 13 and said it had halted mainnet block production, taken validator nodes offline and stopped the affected relayer.

Dave Finances previously reported on Autheo’s mainnet shutdown following the unauthorized THEO mint, when early security alerts focused on 19 million tokens and a reported $1.76 million extraction.

Autheo has not independently confirmed the revised token totals, the precise proceeds or the full technical cause of the incident.

Only 25.49 Million THEO Were Sold for Approximately 291.7 ETH

PublicAML’s transaction reconstruction distinguishes the amount of THEO created from the quantity actually sold.

Following the first mint, the receiving wallet sold 19 million THEO through four transactions routed through Hydrex between 17:16 and 17:17 UTC. Those trades generated approximately 280.70 ETH.

Shortly afterward, 280.45 ETH entered the Relay cross-chain bridge, with approximately 278.52 ETH arriving at the corresponding Ethereum address.

The second mint produced a different outcome. Only approximately 6.49 million of the additional 100 million THEO were sold, generating another 11.04 ETH across three transactions.

By that point, THEO’s market price had already collapsed, sharply reducing the amount of ETH that could be obtained from further sales.

Altogether, approximately 25.49 million THEO were sold for 291.7 ETH, valued at roughly $730,000 using October 12 prices. The investigation also identified a small additional cross-chain transfer involving approximately 0.1 ETH.

This is materially different from treating the entire 119 million newly minted tokens as sold or assigning the attack proceeds the value of the destination wallet’s total balance.

Why the Previously Reported 700.8 ETH Figure Was Misleading

The earlier 700.8 ETH estimate appears to have reflected the balance of the Ethereum wallet receiving funds from the exploit rather than the amount generated by THEO sales alone.

PublicAML traced the wallet’s history back to October 5, when it received 414.4 ETH from another address. Subsequent transfers included approximately 77 ETH moving out through Relay and another 68.4 ETH arriving through NEAR Intents on October 12.

Immediately before the exploit, the wallet held approximately 400.8 ETH.

Following the cross-chain transfers associated with the unauthorized THEO sales, its reported balance reached approximately 700.81 ETH.

The earlier wallet funding therefore accounted for a substantial portion of the balance that had been described as stolen funds.

The revised $730,000 figure represents estimated gross ETH proceeds from selling the unauthorized tokens. It should not be treated as a final measure of the incident’s total economic damage, which could also include liquidity losses, token dilution and recovery costs.

Another 93.5 Million THEO Was Transferred to an Older Wallet

Investigators also identified a separate transfer involving 93,510,011 THEO at 17:57 UTC on October 12, shortly after the second round of sales.

Instead of entering a decentralized exchange, these tokens were transferred to another Base address that had been active since September 2024.

PublicAML found that the destination had previously received funding through transactions associated with Binance and MEXC hot wallets. It had also purchased a small amount of THEO shortly before receiving the much larger transfer.

According to the October 14 investigation, the 93.5 million tokens remained at that address and had not been sold.

However, the receiving wallet’s owner has not been identified. Previous exchange withdrawals do not establish that Binance, MEXC or the account holders associated with those transactions participated in the exploit.

On October 14 at 05:32 UTC, investigators also recorded a 14.56 ETH transfer from the attacker-linked Ethereum wallet to an address that had previously received funds from it on October 5.

The transaction indicates further movement of funds after the original incident, not another unauthorized mint or a newly discovered exploit.

More Unauthorized Tokens Do Not Necessarily Mean More Money Was Stolen

The revised figures reveal why cryptocurrency exploit estimates can become misleading when three separate quantities are treated as interchangeable: tokens created, assets sold and balances held by connected wallets.

In Autheo’s case, the first figure increased dramatically while the second fell relative to earlier reporting.

That apparent contradiction makes sense once market liquidity is considered.

An attacker might create enormous amounts of a token without finding buyers willing to exchange an equivalent amount of ETH or stablecoins for it. As selling pressure drains the available liquidity, each successive token can become considerably less valuable.

The second THEO mint illustrates that problem particularly clearly. Despite creating 100 million additional tokens, the subsequent sales generated only about 11 ETH.

For investors, the practical damage nevertheless extends beyond the ETH extracted. Unauthorized supply can destroy confidence in token scarcity, depress market prices and leave existing holders uncertain about which balances should ultimately be recognized as legitimate.

Dave Finances examined a related liquidity problem in the suspected $12.5 million 79Vault exploit, where suspicious token movements were followed by substantial withdrawals of assets from a trading pool.

The two incidents differ technically, but both demonstrate why token quantities alone provide an incomplete measure of economic harm.

The 93.5 Million Unsold Tokens Create a Difficult Recovery Question

The remaining tokens may now be more consequential to Autheo’s recovery than the revised ETH proceeds.

If the 93.5 million THEO remain accessible and can be transferred, their existence creates an unresolved supply overhang. Even if current market liquidity cannot absorb substantial sales, holders must consider the possibility that those tokens could eventually return to circulation.

Simply assuming they are worthless would be premature. Their economic value depends on future liquidity, the project’s recovery decisions and whether the unauthorized supply remains recognized by the relevant contracts.

Autheo may need to determine whether the affected tokens can be isolated, invalidated or addressed through some other remediation mechanism without disrupting legitimate balances.

Those choices become harder when the recipient’s identity and intentions are unknown.

There is also an important attribution lesson. Public blockchain records establish that one address sent tokens to another. They do not automatically prove that both addresses belong to the same person.

That distinction recently mattered in Dave Finances’ coverage of PeckShield’s disputed $3.89 million hacker-fund attribution, where an incorrect wallet classification led researchers to reconsider a widely circulated claim about stolen cryptocurrency reaching Binance.

Autheo Still Needs to Explain How the Bridge Accepted the Mints

The most consequential unanswered question is no longer how much ETH appeared in one wallet. It is why the bridge accepted messages that resulted in unauthorized token creation.

PublicAML’s findings identify the relayer involved in delivering both messages, but the investigation could not verify the corresponding originating-chain records needed to establish how those messages were produced.

A compromised relayer credential, an incorrectly configured validation mechanism and an error on the originating chain would imply different vulnerabilities and require different remedies.

Until Autheo identifies the actual failure, investors cannot determine whether stopping the affected relayer fully addresses the security problem.

The project’s next technical update should reconcile the 119 million THEO identified in the transaction records, explain the treatment of the unsold tokens and establish what safeguards will prevent another unauthorized mint.

It should also distinguish funds extracted through trading from assets merely present in associated wallets.

The October 14 investigation does not reveal a second attack. It corrects the financial interpretation of the original October 12 incident, showing a larger unauthorized issuance but considerably smaller identifiable ETH sale proceeds.

For THEO holders, that correction matters. The estimated extraction is lower than initially reported, but the outstanding supply and unresolved authorization failure leave substantial uncertainty about the network’s eventual recovery.