After a suspected vulnerability was discovered in the THEO token of Autheo Network, its value plummeted by 92% within 24 hours to $0.006262 on Base.
Blockchain security company PeckShield reported that on October 12, 2026, 19 million THEO were minted on Base.
Autheo has confirmed that it is investigating a security incident and urges users not to buy, sell, or bridge THEO until an official security notice is issued.
The native token THEO of Autheo Network fell by approximately 92% within 24 hours after a suspected cross-chain minting vulnerability was discovered. PeckShield reported that 19 million THEO were minted and exchanged for ETH.
Subsequently, the attacker transferred the funds from Base to Ethereum in order to make it more difficult to track.
How did the suspected THEO hacker incident occur?
According to the report, 19 million THEO tokens were minted on Base on October 12, 2026. On-chain data shows that these tokens were created from a zero address, which is typically used to record newly minted tokens.
Normally, when tokens are transferred between different blockchains, the system will check whether the transfer is valid.
The security monitoring agency Defimon Alerts described this incident as "unsecured cross-chain minting." This means that these 19 million tokens are alleged to have no corresponding locked assets on the originating chain.
The suspected weak link involves a trusted relay, which is a system used for verifying cross-chain messages. If invalid messages are accepted, it is possible to create tokens without proper guarantees.
However, Autheo has not yet confirmed how this casting was authorized.
Subsequently, there appears ETH exchange and bridging transfer.
After the casting process, the wallet exchanged some of the newly created THEO for ETH. A recorded transaction shows that approximately 9.5 million THEO were sent to the trading contract in exchange for 189.06 ETH.
Subsequently, the wallet transferred a portion of ETH from Base to Ethereum. A confirmed bridging transaction sent 280.45 units of ETH from Base, and the associated Ethereum transaction delivered 278.52 units of ETH to the same wallet.
According to PeckShield, this wallet holds approximately 700.8 ETH, worth about $1.76 million. However, this is only the total balance of ETH in that wallet, and not the amount that has been confirmed to be stolen in this incident. On-chain records show that the wallet had already received ETH before the suspected vulnerability occurred.
After these events, the price of THEO fell by 92% to $0.006262 within 24 hours, and concerns about the security of this token on the market increased accordingly.
Autheo Team confirms that a security investigation is underway.
In response to this vulnerability incident, the Autheo team has confirmed that they are investigating a security incident involving THEO. The team stated on X that developers are actively working to identify the issue, but they have not confirmed how the incident specifically occurred.
Before the team issued an official security confirmation, users were advised not to buy, sell, or bridge THEO.
Autheo also warns users not to interact with suspicious links or contracts, and reminds them not to believe in unsolicited recovery or compensation offers.
Meanwhile, the team has not yet confirmed whether this incident was caused by an intrusion into casting permissions, a bridging vulnerability, or some other security issue.
