Autheo THEO unbacked Hyperlane warp-route mint on Base drains about $1.7M

Summary

On 12 October 2026 an attacker minted 19,000,000 THEO on Base without any backing lock on the origin chain. The tokens were dumped across THEO pools on Base. PeckShield reports the hacker swapped them for 700.8 ETH (~$1.76M) and bridged the ETH to Ethereum, and that THEO fell 92% in 24 hours. Defimon Alerts estimates the loss at ~$1.7M.

Affected

• Autheo THEO token on Base (Hyperlane HypERC20 warp-route token, 0xebe516a20238f79dc20b07ead6768e08891ed309)
• Holders of THEO and liquidity providers in THEO pools on Base (THEO/USDC on Hydrex, Uniswap v4 pools)
• No fix announced at time of publication

Impact

Defimon Alerts reports that THEO's Base contract uses a TrustedRelayerIsm interchain security module, so a single relayer key can authorize any inbound interchain message. It says the attacker delivered a Hyperlane message from origin domain 2127 that minted 19,000,000 THEO (tx 0x4fdbbc5e...). An orchestrator contract then sold the unbacked THEO through a 54-swap extraction contract, taking real WETH, USDC, and cbBTC. Defimon describes this as part of a multi-transaction dump campaign. Autheo has confirmed it is investigating a security incident involving THEO. As of publication, Autheo has not published a root cause or confirmed the scope of losses. A separate researcher claims 119M THEO were minted; Autheo has not confirmed that figure and it is not reflected here. It is not confirmed whether the relayer key was compromised, misconfigured, or used by an authorized party.

Recommended actions

• Follow Autheo's notice: do not buy, sell, or bridge THEO until an official all-clear.
• Ignore unsolicited recovery or compensation offers; Autheo says support is only via its official channels.
• Exchanges and bridges: block deposits from the attacker address below and monitor the bridged ETH on Ethereum.
• Teams running Hyperlane warp routes: review whether your ISM relies on a single trusted relayer key.

Source & attribution

This 0xCERT advisory summarises alerts by PeckShield (https://x.com/PeckShieldAlert/status/2109933198096711890) and Defimon Alerts (https://x.com/DefimonAlerts/status/2109918883037454782), and Autheo's security notice (https://x.com/Autheo_Network/status/2109754728519213343). Indicators are copied from the Defimon alert and the PeckShield alert's BaseScan screenshot. Details may change; refer to the original sources for the authoritative record.