THEO Bridge Exploit After $1.76M ETH Transfer, Price Drops 92%

Autheo Network’s native (THEO) token has crashed around 92% in 24 hours following a suspected cross-chain mint exploit on Base. Blockchain security platform PeckShield reported that 19 million THEO tokens were minted and swapped for ETH.

The attacker then bridged to ETH from Base to Ethereum to make the funds harder to track.

How the Suspected THEO Hack Happened?

According to the report, 19 million THEO tokens were minted on Base on October 12, 2026. On-chain data shows the tokens were created from the zero address, which is commonly used to record newly minted tokens.

Normally, when tokens move between blockchains, the system checks that the transfer is valid.

Security monitor Defimon Alerts described this incident as an “unbacked cross-chain mint.” This means the 19 million tokens allegedly had no matching assets locked on the originating chain.

The suspected weakness involved a trusted relayer, a system that verifies cross-chain messages. If an invalid message was accepted, it could allow tokens to be created without proper backing. 

However, Autheo has not confirmed exactly how the mint was authorized.

ETH Swaps and Bridge Transfers Follow

After the mint, the wallet swapped some of the newly created THEO tokens for ETH. One recorded transaction shows about 9.5 million THEO sent to trading contracts, returning 189.06 ETH to the wallet.

The wallet then moved some ETH from Base to Ethereum. A confirmed bridge transaction sent 280.45 ETH from Base, while the linked Ethereum transaction delivered 278.52 ETH to the same wallet.

PeckShield reported that the wallet held about 700.8 ETH, worth roughly $1.76 million. However, this was the wallet’s total ETH balance, not a confirmed amount stolen in the incident. On-chain records show that the wallet had received ETH before the suspected exploit.

Following the activity, THEO’s price fell 92% to $0.006262 over 24 hours, as the incident raised concerns about the token’s security.

Autheo Team Confirms Security Investigation

Responding to the exploit, the Autheo team has confirmed that it is investigating a security incident involving THEO. In a statement on X, the team said its developers are actively looking into the issue but did not confirm how the incident happened.

Until the team issues an official all-clear, users have been told not to buy, sell, or bridge THEO. 

Autheo also warned users against interacting with suspicious links or contracts and cautioned them not to trust unsolicited recovery or compensation offers.

Meanwhile, the team has not yet confirmed whether the incident resulted from compromised minting permissions, a bridge vulnerability, or another security issue.