Autheo's THEO token on Base exploited for ~$1.7M via a compromised Hyperlane relayer, allowing unbacked cross-chain minting and extraction of real assets through multi-swap cascade.
Security & Exploits ·
Autheo's THEO token on Base suffered an estimated $1.7M loss after an attacker exploited a vulnerability in its Hyperlane cross-chain messaging setup. The token operates as a HypERC20 warp-route asset secured by a TrustedRelayerIsm module, a design that permits a single relayer key to authorize any inbound interchain message. An attacker sent a Hyperlane message from origin domain 2127 that triggered the minting of 19,000,000 THEO without corresponding backing or a lock on the origin chain.
Following the unbacked mint, the attacker moved 9.5M of the newly created THEO through a cascade of 54 swaps designed to extract real value from liquidity pools. The extraction engine routed tokens through the THEO/USDC pair and Uniswap v4 and Hydrex pools, resulting in approximately $700K withdrawn in WETH, USDC, and cbBTC. A single liquidity pair involving THEO and USDC recorded a $476K loss of USDC.
The incident appears tied to a broader multi-transaction dumping campaign. The vulnerability stems from THEO's reliance on a single trusted relayer for cross-chain authorization, allowing a compromised or malicious key holder to mint tokens freely without backing verification.