Autheo keeps mainnet halted after 219 million unauthorized THEO creation

Autheo said on October 20 that its mainnet remains suspended while developers correct an Inter-Blockchain Communication validation flaw that the project says enabled approximately 219 million unauthorized THEO to be created on October 12.

The update matters because it replaces Autheo’s initially limited incident disclosure with a claimed cause, a larger affected-supply estimate and a staged recovery plan. It does not establish a restart date, final financial loss or completed treatment for tokens held by users who traded after the exploit.

Autheo identifies an IBC validation failure

According to the project, an attacker established an IBC connection from an external blockchain under the attacker’s control. An asset introduced through that connection was incorrectly recognized as eligible for conversion into native THEO on Autheo Mainnet.

Autheo attributed approximately 219 million unauthorized THEO to that mainnet failure. It said some tokens subsequently crossed existing infrastructure to Base and Robinhood Chain, where approximately 28 million THEO were sold. Those figures cover the company’s reconstruction of activity across several networks; Autheo has not published the promised transaction-by-transaction supply reconciliation or technical post-mortem.

The company explicitly said the Base and Robinhood Chain bridges were pathways used after the original issuance rather than the source of the vulnerability. That account is more specific than Autheo’s October 13 notice, which confirmed unauthorized minting, transfers to Base and a coordinated halt but said the scope and financial impact were still unknown.

A narrower Base-chain reconstruction

PublicAML’s independent October 14 reconstruction measured only activity visible on Base and Ethereum, before Autheo disclosed its broader findings. It identified two Base mints totaling 119 million THEO between 17:06 and 17:45 UTC on October 12.

The analysis calculated that 25.49 million of those Base tokens were sold between 17:16 and 17:50 UTC for approximately 291.7 ETH. PublicAML derived that amount from seven swaps and associated bridge transfers. It did not independently read Autheo Mainnet and therefore could not determine whether the cross-chain messages were forged at the relayer or produced incorrectly on the origin chain.

The 119 million-token Base measurement and Autheo’s approximately 219 million-token mainnet estimate describe different network populations and observation windows. They should not be added together or treated as directly contradictory. The difference remains unresolved until Autheo publishes transaction identifiers and its final reconciliation.

Recovery remains conditional

Autheo said it has identified the vulnerable code path, restricted significant quantities of affected supply and engaged ZeroShadow for forensic investigation and fund tracing. Those are company-reported actions; the October 20 update provides no independent verification report or exact restricted-token balance.

The project divided recovery into four stages: remediation and independent review, a controlled mainnet restart, gradual restoration of approved cross-chain routes, and final publication of a post-mortem and supply reconciliation. Core mainnet functions would return before affected bridges, which may reopen with transaction limits and additional controls.

Autheo also said some bridge transfers initiated around October 12 remain pending. It has not specified how those transfers, unauthorized tokens acquired through ordinary trading or other good-faith balances will be handled.

What remains unverified

The latest disclosure narrows the alleged technical cause but remains the project’s account of its own incident. No reviewed source establishes the attacker’s identity, the final economic loss, how much unauthorized supply remains transferable or when validators will resume block production.

Coinburn is publishing on October 21, one day after the expanded disclosure and nine days after the incident. The relevant transaction window in the independent analysis is October 12 from 17:06 through 17:50 UTC on Base; it does not measure all activity claimed across Autheo Mainnet, Base and Robinhood Chain.