Autheo THEO: Unbacked Cross-Chain Mint via Compromised Hyperlane Relayer Key

Root Cause

Hyperlane is a permissioned cross-chain messaging protocol that relies on a set of validators/relayers to attest to cross-chain messages. When the receiving chain's Mailbox contract processes an inbound message, it calls the destination contract's handle() function. If the THEO token contract's handle() performed minting without verifying that an equivalent amount was locked on the origin chain, a forged (but cryptographically valid from the relayer's perspective) message triggers unbacked issuance.

// Simplified Hyperlane message processing
contract TheoToken is IMessageRecipient {
    function handle(
        uint32 origin,
        bytes32 sender,
        bytes calldata message
    ) external override onlyMailbox {
        (address recipient, uint256 amount) = abi.decode(message, (address, uint256));
        // BUG (suspected): no cross-chain lock verification before mint
        _mint(recipient, amount);
    }
}

With a compromised or stolen relayer key, the attacker was able to construct a message that passed onlyMailbox validation and directly triggered _mint() for 19 million THEO tokens without any corresponding asset being locked on the origin chain.

Attack Steps

Note: PeckShield initially reported 19M tokens minted; one researcher claimed 119M. Autheo has not published a definitive figure. MEXC halted THEO transfers on October 13 as the investigation began.

Impact

• Loss: ~$1,760,000 (700 ETH at time of exploit)
• Chain: Base (Coinbase L2, EVM-compatible)
• Token impact: THEO/USDC pool liquidity drained; THEO price fell ~92% in 24 hours
• Collateral damage: Robinhood Chain shares the same Hyperlane deployment, potentially exposing its token bridge to the same relayer-key risk
• Status: Root cause (Autheo deployment vs. shared Hyperlane stack) unconfirmed as of October 13

Lessons for Auditors

1. Hyperlane's handle() is not a trust boundary by itself. The onlyMailbox guard only verifies the call came from the local Mailbox contract; it does not verify that the message represents a genuine locked-and-burn event on the origin chain. Auditors must verify that minting logic includes an origin-chain lock proof or equivalent.
2. Relayer key compromise is a bridge-level risk, not just an ops risk. Any bridge that gates minting behind a single hot relayer key has a single point of failure. Audit the key management and multisig/threshold setup, not just the contracts.
3. Shared bridge deployments create shared blast radius. When multiple protocols share the same Hyperlane mailbox and relayer set, a compromised key impacts all of them. Document and audit cross-protocol dependencies.
4. Unbacked-mint patterns should trigger circuit breakers. A token contract that can receive mint calls from a cross-chain message should enforce a per-block or per-epoch minting cap to limit damage from relayer compromise.