Autheo's THEO token crashes over 90% from $0.08 to $0.006 following a $1.76 million exploit on its Base cross-chain bridge on October 12, 2026. An attacker exploits a single trusted relayer key on Hyperlane's bridge protocol to mint 19 million unbacked tokens, dumping them across Base liquidity pools for 700.8 Ether. Autheo urges users to halt trading and bridging, while exchange MEXC freezes transfers as investigations proceed.
Market impact on THEO price
- ▪The price of Autheo's THEO token collapsed over 90% from approximately $0.08 to $0.006 within 24 hours following the October 12, 2026 exploit.
- ▪Thin trading liquidity for Autheo's THEO token on Base-based decentralized exchange Hydrex significantly amplified market sell pressure during the unbacked token dump.
Emergency response and exchange actions
- ▪Autheo issued a security notice on October 12, 2026, advising cryptocurrency traders and users not to buy, sell, or bridge THEO tokens while an investigation remains ongoing.
- ▪Centralized cryptocurrency exchange MEXC suspended THEO token deposits and withdrawals on October 13, 2026, at the explicit request of the Autheo team.
Exploit execution and token swapping
- ▪On October 12, 2026, an attacker exploited a Hyperlane bridge setup on Base to mint 19 million unbacked Autheo THEO tokens without locking collateral on the origin chain.
- ▪The attacker swapped the 19 million minted Autheo THEO tokens on Base liquidity pools for approximately 700.8 Ether, valued at $1.76 million, before bridging the funds to Ethereum.
- ▪An orchestrator address beginning with 0x599b routed 9.5 million minted Autheo THEO tokens through roughly 54 swaps across the THEO/USDC pool, Uniswap v4 positions, and Hydrex pools.
Hyperlane bridge security vulnerability
- ▪Hyperlane's production deployment guidelines state that command-line warp route deployments enable the Trusted Relayer ISM module by default for testing and instruct development teams to remove it before launching.
- ▪The Autheo THEO token contract on Base was secured by Hyperlane's TrustedRelayerIsm module, which allows a single relayer address to execute arbitrary messages without multi-party validator checks.
Autheo security posture
- ▪On October 8, 2026, Autheo published a blog post analyzing the NEAR Intents exploit, stressing the need to scrutinize deposit infrastructure handoffs.
- ▪Prior to the October 2026 exploit, Autheo's cross-chain bridge infrastructure had undergone security audits conducted by Halborn, CertiK, and Avelar Labs.
Autheo Mainnet details
- ▪Autheo launched its mainnet on May 14, 2026, as a Layer-0 operating system with an integrated Layer-1 blockchain supporting validator staking and transaction fees.
- ▪As of September 2026, Autheo counted 151 active validators operating across its network.
Debatable claims
- ▪Hyperlane's default enablement of single-relayer security modules creates unacceptable risks for launching projects
- ▪Autheo bears primary financial responsibility for compensating THEO token holders after the Base bridge exploit
- ▪Single-verifier bridge setups are fundamentally inadequate for securing cross-chain token transfers
- ▪Third-party smart contract audits fail to provide adequate security guarantees for cross-chain bridges
Story comments
Loading comments…