Autheo’s THEO token lost roughly 92% of its value in 24 hours after 19 million tokens were minted without authorization on Base, in what is being treated as a suspected bridge exploit.
The incident, which unfolded on October 13, 2026, leaves the harder question open. Autheo moves THEO between its own mainnet, Base and Robinhood Chain through a bridge built on the Hyperlane interoperability protocol, on the official bridged contract 0xebE516a20238F79DC20b07eaD6768e08891Ed309. Root cause is unconfirmed, and that leaves two possibilities with very different blast radii. Either the flaw sits in Autheo’s own deployment, or it sits deeper in shared bridging infrastructure also used to reach Robinhood Chain.
The damage on the day is clearer. The attacker reportedly swapped the minted tokens for about 700.8 ETH, roughly $1.76 million at the time, a figure reported but not independently confirmed on-chain. THEO fell from around $0.08 to about $0.006 within a day. Thin liquidity on Base venues such as Hydrex amplified the sell pressure, and the funds were moved off Base, which makes recovery harder. Autheo urged users not to buy, sell or bridge THEO while it investigates.
Timing sharpens the network-wide question. Autheo launched its mainnet on May 14, 2026, THEO began trading at $0.05 on August 20, and the token listed on MEXC on October 1, thirteen days before the mint. The project had been audited by Halborn, CertiK and Avelar Labs, yet the exploit hit its cross-chain layer. If investigators point at the Hyperlane layer rather than Autheo’s configuration, other chains and tokens using the same bridging stack would have to re-examine their own exposure, because the same tunnel connects to Robinhood Chain. If it points at Autheo, the lesson is narrower: a three-audit stack still failed at its newest component. The investigation is ongoing.
