No timelock, no chill: attacker mints 10B TOP tokens and walks off with $1.5M in WETH 🕳️

An attacker exploited a governance misconfiguration in the Token of Power (TOP) ecosystem to mint 10 billion TOP tokens and drain approximately $1.5 million from a Balancer liquidity pool on Ethereum, according to blockchain security firm Blockaid. The exploit pulled 944.2 WETH, worth about $1.58 million, from the TOP/WETH Balancer V1 pool, while researchers stressed that Balancer itself was not vulnerable.

Blockaid and CertiK reported that the attacker accumulated more than 50% of TOP's token supply before submitting a governance proposal that minted billions of new TOP tokens directly to an attacker-controlled contract. The exploit relied on a misconfiguration in the Aragon DAO tied to TOP's MiniMeToken structure. According to Blockaid, the governance system permitted proposal creation, voting, and execution within a single transaction because no timelock protections were in place. "The Aragon Voting app allowed create → vote → execute in a single tx with no timelock," Blockaid said in its analysis.

CertiK separately reported that the attacker initially withdrew 662 ETH from Tornado Cash before accumulating enough TOP tokens to gain majority governance control. The firm also confirmed the same 944.2 WETH figure drained from the Balancer V1 pool, with losses totaling roughly $1.5 million.

The incident highlights how governance systems themselves can become attack surfaces in DeFi protocols. Unlike exploits involving coding flaws or reentrancy bugs, governance takeovers weaponize administrative permissions and voting mechanisms already embedded inside protocols. Timelocks are commonly used in DAO systems to slow governance execution and give communities time to react to malicious proposals; in this case, researchers said the absence of execution delays allowed the exploit to unfold instantly. The attack adds to ongoing scrutiny of legacy DAO frameworks, including Aragon and MiniMeToken-based governance systems, that remain in use on Ethereum.