Unauthorized THEO minted on Base sold for 700.8 ETH and sank the token 92% in a day

Divide the $1.76 million of proceeds by the 19 million tokens PeckShield counted and the attacker averaged about $0.093 a token ^[21]. At the $0.08 pre-incident quote ^[2], those tokens were worth $1.52 million, so the sale cleared about $240,000 above the quoted price ^[22] into pools Cryptobriefing described as thin ^[5]. A forced seller in thin pools should sell below the quote. Either the quote is rounded, or the 19 million is only part of what was sold, or the fills came in tranches before the slide.

The mint count has a larger gap. Vlad's 119 million is 100 million tokens above PeckShield's 19 million ^[13], and crypto.news noted that the available statements do not establish whether the two describe the same transactions ^[11]. The 93.5 million THEO that Zynex says landed in his wallet is 4.9 times PeckShield's figure ^[23]. If those tokens were minted in this event, 19 million is the slice that was sold and not the whole mint.

Vlad's description of 119 million as roughly 70% of supply ^[10] also sits badly with the token's design. With a 7 billion maximum and about 5.3% circulating at launch ^[9], 119 million is about 32% of the launch float and 1.7% of the cap ^[12].

Zynex, who offered to return the tokens, said: "Not mine. Didn't touch it. Not selling, not swapping, not moving," ^[17]. A screenshot he posted valued the wallet's holdings above $1 million ^[18]. At $0.006 a token, the 93.5 million THEO alone would be worth about $561,000 ^[24], so the gap is either other holdings or a stale price.

On the thesis that bridge minting rights are a single point of failure, we think the evidence supports a narrower claim. THEO on Base is a bridged token on a Hyperlane-based route that also links Autheo's mainnet and Robinhood Chain ^[7], and whatever failed let one party create tokens the market then absorbed. Liquidity limited the take: crypto.news wrote that the value an attacker can obtain from unauthorized tokens depends on the liquidity available to exchange them ^[6], and here that came to $1.76 million ^[1].

If the suspicion holds, the single point of failure is the minting permission. The counter-thesis is that the fault sits in Autheo's own deployment. Autheo has not confirmed Hyperlane as the source ^[15], and Cryptobriefing says the exact root cause is unconfirmed ^[14]. A root-cause report naming a misconfigured Autheo contract or a compromised Autheo key would end the bridge argument for this case.

Halborn, CertiK and Avelar Labs audited Autheo ^[8]; the sources do not say what the audits covered.