-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0237 ============================================================ Advisory-ID: 0xCERT-2026-0237 Severity: High Published: 2026-10-12T21:14:59.000Z Updated: 2026-10-13T20:37:10.033Z Chains: Base, Ethereum URL: https://www.0xcert.com/advisory/0xCERT-2026-0237 Title: Autheo THEO unbacked Hyperlane warp-route mint on Base drains about $1.7M Summary - ------- An attacker minted 19M unbacked THEO on Base through Autheo's Hyperlane warp route, then swapped it for about 700.8 ETH (~$1.76M per PeckShield) and bridged the ETH to Ethereum. Autheo says not to buy, sell, or bridge THEO until it gives an all-clear. Details - ------- Summary On 12 October 2026 an attacker minted 19,000,000 THEO on Base without any backing lock on the origin chain. The tokens were dumped across THEO pools on Base. PeckShield reports the hacker swapped them for 700.8 ETH (~$1.76M) and bridged the ETH to Ethereum, and that THEO fell 92% in 24 hours. Defimon Alerts estimates the loss at ~$1.7M. Affected - - Autheo THEO token on Base (Hyperlane HypERC20 warp-route token, 0xebe516a20238f79dc20b07ead6768e08891ed309) - - Holders of THEO and liquidity providers in THEO pools on Base (THEO/USDC on Hydrex, Uniswap v4 pools) - - No fix announced at time of publication Impact Defimon Alerts reports that THEO's Base contract uses a TrustedRelayerIsm interchain security module, so a single relayer key can authorize any inbound interchain message. It says the attacker delivered a Hyperlane message from origin domain 2127 that minted 19,000,000 THEO (tx 0x4fdbbc5e...). An orchestrator contract then sold the unbacked THEO through a 54-swap extraction contract, taking real WETH, USDC, and cbBTC. Defimon describes this as part of a multi-transaction dump campaign. Autheo has confirmed it is investigating a security incident involving THEO. As of publication, Autheo has not published a root cause or confirmed the scope of losses. A separate researcher claims 119M THEO were minted; Autheo has not confirmed that figure and it is not reflected here. It is not confirmed whether the relayer key was compromised, misconfigured, or used by an authorized party. Recommended actions - - Follow Autheo's notice: do not buy, sell, or bridge THEO until an official all-clear. - - Ignore unsolicited recovery or compensation offers; Autheo says support is only via its official channels. - - Exchanges and bridges: block deposits from the attacker address below and monitor the bridged ETH on Ethereum. - - Teams running Hyperlane warp routes: review whether your ISM relies on a single trusted relayer key. Source & attribution This 0xCERT advisory summarises alerts by PeckShield (https://x.com/PeckShieldAlert/status/2109933198096711890) and Defimon Alerts (https://x.com/DefimonAlerts/status/2109918883037454782), and Autheo's security notice (https://x.com/Autheo_Network/status/2109754728519213343). Indicators are copied from the Defimon alert and the PeckShield alert's BaseScan screenshot. Details may change; refer to the original sources for the authoritative record. References - ---------- - - https://x.com/PeckShieldAlert/status/2109933198096711890 - - https://x.com/DefimonAlerts/status/2109918883037454782 - - https://x.com/Autheo_Network/status/2109754728519213343 - - https://basescan.org/tx/0x4fdbbc5e7d18e92790a6b21d6711a12a5cbb0557b829efde3901e682cd73cd88 - - https://basescan.org/tx/0x9d2a604246abdd8b8a847049f114a670218d307a3160d37a0c4e567edde73fcb - - https://crypto.news/autheo-theo-token-plunges-92-after-suspected-bridge-exploit Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmrOw7kJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmfIWMbtDWFSea/lHI+8iXeDxaVsFQBGZ0vGHOhB 7EfLaRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAADYXQD/fLRMvT1+z4gdyV3a Yc//etSCcWNRE/xS5zp3mjUGWCMA/31O8rKf+QemVSwZMu7Hh6R5mwCVTuxN xK8+TdfZAvUJ =aPpW -----END PGP SIGNATURE-----