Autheo is investigating a suspected security incident involving its THEO token after a sharp market collapse on Oct. 13. The project told holders not to buy, sell, or bridge THEO until further notice while its development team reviews what happened.

The project has not published the full scope of the breach, the exact vulnerability involved, or an estimate of losses. Outside researchers and blockchain security firms have offered differing accounts of how many tokens may have been minted without authorization, but Autheo has not confirmed those figures.

PeckShield traced newly minted tokens on Base

Blockchain security firm PeckShield said an attacker minted 19 million THEO on Base, then swapped the tokens for 700.8 ETH, valued at about $1.76 million at the time of the report. According to PeckShield, the ETH was then bridged to Ethereum.

The firm also said THEO fell 92% over 24 hours after the incident. That sell-off followed the appearance of newly minted tokens and their conversion into available liquidity, according to the public reporting cited in the investigation window.

Researchers point to possible bridge weakness

Early commentary from blockchain researchers suggested the incident may involve Hyperlane cross-chain bridge infrastructure. One researcher, posting from an account operated under the name Vlad, claimed the attacker minted about 119 million THEO without authorization.

That estimate is far larger than the 19 million tokens identified by PeckShield. The researcher described the higher figure as roughly 70% of THEO’s supply and said the attacker sold tokens into liquidity pools, intensifying the price collapse. Autheo has not confirmed the 119 million figure, and the available public statements do not show whether the reported transactions were all part of the same sequence.

Unrelated wallet says it received 93.5 million THEO

A separate development added to the uncertainty around the incident. A verified X user said a wallet linked to the attacker transferred 93.5 million THEO to his address despite no prior involvement on his part.

The wallet holder publicly asked Autheo to provide an official return address and said he was willing to send the full amount back to the project. As of the source report, there was no confirmation from Autheo on whether that transfer had been validated or how any recovery process would be handled.

Autheo freezes guidance while investigation continues

Autheo’s only formal guidance so far has been precautionary. In its Oct. 13 security notice, the project warned users not to trade or bridge THEO and also cautioned them against interacting with suspicious contracts or links.

The team has not announced a timeline for recovery, a compensation plan, or a date for resuming normal token activity. For now, the next confirmed step is the ongoing internal investigation, with market participants waiting for Autheo to clarify the attack path, confirm the token movements, and outline any remediation measures.

Source: crypto.news