Autheo THEO incident: IBC asset-validation flaw

Not stated in USD by Autheo. Autheo: ~219 million unauthorized THEO created; ~28 million sold on Base and Robinhood Chain. Secondary estimates disagree: ~$1.7M (0xCERT), 700.8 ETH (~$1.76M) (PeckShield, via Nexus Mutual), ~292 ETH (PublicAML). Caveats from those sources: PublicAML says the 700.8 ETH figure is the balance of the attacker's Ethereum wallet after the bridge, "and about 400 ETH of it was already there before the attack"; Nexus Mutual says "The $1.7 million headline that circulated therefore likely includes ETH that was never Autheo's."

Root cause: Per Autheo: Autheo Mainnet's IBC asset-validation mechanism incorrectly recognized an attacker-introduced asset as eligible for conversion into native THEO. Accounts from PublicAML (14 Oct, before Autheo's 20 Oct update; it says "We cannot read Autheo’s chain from here") and Nexus Mutual (21 Oct) describe unbacked mints on Base through a Hyperlane warp route. Full technical post-mortem not yet published.

Timeline, as sourced: 12 Oct 2026; Autheo community update 20 Oct 2026.

Autheo halted its mainnet on 12 October 2026 after the unauthorized creation of THEO. In a community update (opens in a new tab) published on 20 October, the team said an attacker established an IBC connection from an external blockchain under its control and introduced an asset that Autheo Mainnet incorrectly recognized as eligible for conversion into native THEO. About 219 million unauthorized THEO were created. Part of that supply moved to Base and Robinhood Chain, where about 28 million THEO were sold. Autheo says the Base and Robinhood Chain bridges "were not identified as the source of the original unauthorized issuance" and were among the pathways through which tokens moved after the incident, and notes the affected code had been through a prior third-party audit. Other accounts describe the mechanism differently: PublicAML (opens in a new tab), published on 14 October, before Autheo's 20 October update, and Nexus Mutual (opens in a new tab), published on 21 October, describe unbacked mints on Base through Autheo's Hyperlane warp route. PublicAML adds: "We cannot read Autheo’s chain from here." Autheo has not stated a dollar loss and plans a full technical post-mortem after remediation.