Key Takeaways:
- An attacker seized governance control of Token of Power's Aragon DAO.
- They minted 10 billion TOP tokens and drained 944.2 WETH from Balancer V1.
- BlockSec Phalcon warned projects to review governance safeguards immediately.
Back
Token of Power loses $1.58M in Aragon DAO governance exploit
An attacker exploited a governance misconfiguration in Token of Power's Aragon DAO, draining $1.58 million from a Balancer V1 pool on June 9.
"Projects using similar Lido/Aragon governance implementations should carefully review their voting power distribution, quorum and pass thresholds, mint permissions, and related governance safeguards," BlockSec Phalcon said in a post-mortem analysis.
The attacker, funded through Tornado Cash, acquired over 50% of the 16,384 total TOP supply. In a single transaction, they created, voted on, and executed a malicious proposal that triggered the TokenManager to mint 10 billion TOP tokens directly to their contract. The newly minted tokens were swapped for 944.2 WETH in the TOP/WETH Balancer V1 pool on Ethereum, depleting its liquidity. The stolen funds were routed back through Tornado Cash, complicating recovery efforts. No losses occurred to Balancer's core protocol.
The exploit adds to a pattern of governance attacks on smaller DeFi projects in 2026, where low liquidity and lax parameters make takeovers affordable. While major protocols have strengthened defenses with timelocks and higher quorums, many emerging tokens on Aragon and similar stacks remain exposed, likely drawing increased scrutiny from security firms and calls for governance upgrades.
BlockSec Phalcon's warning extends beyond TOP. Any project using Aragon DAO with MiniMeToken and low supply distribution faces similar risk. The attack required no code exploit — only a governance parameter that allowed a single entity to hold majority voting power without a timelock or quorum safeguard. For investors in low-cap DeFi tokens, the event underscores the importance of verifying governance parameters and monitoring large token accumulations before providing liquidity.
This article is for informational purposes only and does not constitute investment advice.
