AUTHEO COMMUNITY UPDATE

AUTHEO COMMUNITY UPDATE

Security Incident, Recovery Progress, and the Path Forward

October 20, 2026

A week ago, on October 12, Autheo Mainnet was halted following a security incident involving the unauthorized creation of THEO. Since that time, our engineering and security teams, infrastructure partners, and independent forensic specialists have been working to understand the incident, secure the network, trace the affected assets, and establish a responsible path toward recovery.

We recognize the uncertainty this has created for our community, validators, token holders, and ecosystem partners. We also understand that restoring confidence requires more than assurances. It requires transparency, independently verified security improvements, and a carefully executed recovery.

Today, we want to share what we know, the progress we've made, and the principles guiding our next steps.

What Happened

On October 12, an attacker exploited a vulnerability in the way Autheo Mainnet validated certain incoming assets through its Inter-Blockchain Communication (IBC) integration.

The attacker established an IBC connection from an external blockchain under their control and introduced an unauthorized asset that was incorrectly recognized as eligible for conversion into native THEO.

As a result, approximately 219 million unauthorized THEO were created on Autheo Mainnet.

A portion of those tokens subsequently moved through existing cross-chain infrastructure to Base and Robinhood Chain, where approximately 28 million THEO tokens were sold. We are currently tracking a quantity of funds transferred to the ETH mainnet that are linked to the sale of the unauthorized THEO tokens.

Importantly, the vulnerability originated within Autheo Mainnet's IBC asset-validation mechanism. The Base and Robinhood Chain bridges were not identified as the source of the original unauthorized issuance. Rather, they were among the pathways through which tokens moved after the incident.

The movement or possession of THEO tokens on another network does not, by itself, establish that a wallet owner participated in the attack. Our investigation carefully distinguishes the original exploit from subsequent transfers, market transactions, and the activities of legitimate holders.

Autheo Mainnet was halted on October 12 to contain the incident and remains suspended while recovery and security verification continue.

Actions Taken Since the Incident

Our teams have made significant progress across several critical areas.

1. Containing the Vulnerability

Mainnet operations and affected cross-chain services were suspended following the incident. The unauthorized IBC pathway has been identified, and measures have been taken to prevent its continued use.

Our engineering team has identified the vulnerable code path and is developing and testing the necessary corrections.

2. Identifying and Securing Affected Supply

Working with our infrastructure and forensic partners, we've traced substantial movements of unauthorized THEO across the affected networks.

Significant quantities of the affected supply have been identified and restricted. We are continuing to reconcile the precise amounts, current balances, and transaction histories before determining the appropriate treatment of the remaining affected tokens.

Our objective is to ensure that unauthorized issuance does not create a permanent increase in legitimate THEO supply, while carefully considering the rights and interests of good-faith holders.

3. Conducting Cross-Chain Forensic Analysis

We've reconstructed the principal transactions associated with the incident across Autheo Mainnet, Base, Robinhood Chain, and Ethereum.

Our work includes tracing unauthorized issuance, cross-chain movements, token sales, proceeds, and pending transactions. Detailed reconciliation remains underway to ensure that recovery actions are based on verified information rather than assumptions.

4. Engaging Independent Specialists

We're working with ZeroShadow on forensic investigation and fund tracing, while coordinating with infrastructure providers, exchanges, and other relevant counterparties.

Independent technical verification will be an essential requirement before affected network services resume.

5. Preparing a Secure Recovery

Our engineering and security teams are developing the technical recovery procedures, including corrections to the affected IBC functionality and safeguards intended to prevent similar vulnerabilities from being exploited.

These changes will undergo testing and independent review before implementation.

Our Commitments to the Community

The recovery process will be guided by five principles.

1. Protect the Integrity of THEO Supply

The approximately 219 million THEO created without authorization must be addressed through a transparent and technically sound recovery process.

Our objective is to prevent unauthorized issuance from remaining as an additional source of legitimate circulating supply.

Once the recovery is complete, we intend to publish a detailed supply reconciliation so the community can independently understand the outcome.

2. Protect Good-Faith Token Holders

We recognize that THEO may have changed hands through ordinary market transactions following the incident.

Holding or acquiring THEO tokens does not, by itself, indicate involvement in the exploit.

Protecting legitimate balances, respecting good-faith market participants, and minimizing unnecessary disruption are central considerations in evaluating the available recovery options.

We will not presume wrongdoing based solely on wallet ownership or token provenance.

3. Require Independent Security Verification

We will not restart affected services simply because a software correction has been completed.

Although the affected code had been reviewed in a prior third-party audit, this incident shows that audits alone are not sufficient, which is why independent verification will be paired with ongoing monitoring and additional safeguards.

The relevant code, security controls, and recovery procedures must undergo rigorous testing and independent technical review.

Security verification, rather than an arbitrary deadline, will determine when services are ready to resume.

4. Restore Operations Carefully and in Stages

Mainnet operations, cross-chain transfers, and related services will be restored through a controlled process.

Each stage will have defined technical and security requirements, and affected bridges will remain restricted until their reopening conditions have been satisfied.

5. Communicate Transparently

We are committed to providing meaningful updates as the recovery progresses.

After the vulnerability has been corrected and the necessary security reviews are complete, we intend to publish a comprehensive technical post-mortem addressing the incident, its root cause, corrective actions, and the resulting supply reconciliation.

Strengthening Autheo's Security Architecture

Our responsibility extends beyond correcting the specific vulnerability involved in this incident.

We are undertaking a broader review of Autheo's security architecture, including the safeguards protecting native THEO issuance, IBC connectivity, cross-chain transfers, and ecosystem liquidity.

Areas under evaluation include:

• Stronger verification of IBC asset origins, denominations, and authorized conversion routes.
• Additional safeguards against unauthorized native-token issuance.
• Real-time monitoring of token supply, cross-chain transfers, and unusual transaction activity.
• Bridge transaction limits and automated circuit breakers capable of containing suspicious activity where technically supported.
• Enhanced monitoring of liquidity pools and abnormal trading patterns.
• Improved emergency-response procedures, independent security testing, and ongoing operational oversight.

We are also evaluating specialized blockchain security platforms that may provide additional real-time threat detection and automated response capabilities.

Our objective is to build a more resilient Autheo, with security protections designed not only to identify threats but to prevent or contain them wherever technically possible.

The Road to Recovery

Rather than announce dates before the necessary security work is complete, we're organizing the recovery around four defined stages.

Stage 1: Remediation and Independent Verification

Complete the technical corrections, finalize the recovery procedures, perform comprehensive testing, and obtain independent security verification.

Stage 2: Controlled Mainnet Restart

Resume Autheo Mainnet operations with validators under enhanced monitoring and security controls. Core network functionality will be prioritized while affected cross-chain routes remain restricted.

Stage 3: Gradual Restoration of Cross-Chain Services

Restore approved bridge routes and coordinate with exchanges, infrastructure providers, and liquidity venues as appropriate.

Reopening will be gradual, with additional safeguards and transaction limits where necessary.

Stage 4: Final Reconciliation and Public Reporting

Publish the technical post-mortem, the results of the supply reconciliation, and a summary of the security improvements implemented.

Each stage will proceed only after its required conditions have been satisfied. We will provide updates as meaningful milestones are reached.

Pending Bridge Transfers

We recognize that some community members initiated bridge transfers around October 12 that have not yet been completed.

These transactions are being reviewed as part of the cross-chain reconciliation process.

Please do not initiate replacement transfers or attempt to repeat pending bridge transactions.

We will provide specific instructions for affected users once the relevant recovery procedures have been finalized and verified.

Important Guidance for the Community

While Mainnet and affected bridge services remain suspended, please exercise caution and rely exclusively on official Autheo communications.

• Do not initiate new bridge transfers until the relevant services are officially reopened.
• Be cautious of unofficial recovery instructions, token migration announcements, or requests to connect wallets to unfamiliar websites.
• Autheo representatives will never ask for your seed phrase, private keys, or wallet recovery credentials.
• Do not respond to unsolicited messages claiming to offer token recovery, compensation, or priority access.
• Verify announcements through Autheo's official website and established community channels.

Moving Forward Together

Autheo was built with a long-term vision: to provide an integrated Internet operating system connecting blockchain infrastructure, decentralized applications, and emerging technologies.

That vision remains unchanged.

The October 12 incident exposed a serious vulnerability that we are addressing with the urgency and diligence it requires. We also recognize that the strength of a network is measured not only by its technology, but by how responsibly its team responds when confronted with adversity.

Our priority is to restore Autheo safely, protect the integrity of THEO, treat legitimate ecosystem participants fairly, and implement the security improvements necessary to support our long-term development.

We will continue communicating as the recovery progresses, as material developments warrant.

Thank you to our validators, partners, developers, and community members for your patience, understanding, and continued support.

We are committed to bringing Autheo back stronger, more secure, and better prepared for the future.

The Autheo Team