What happened
On June 9, 2026, an attacker acquired a voting majority in Token of Power, minted 10 billion TOP through Aragon governance, and sold the new tokens into a Balancer pool.
Technical root cause
A token-weighted Aragon DAO let a purchasable majority immediately execute an uncapped self-mint; the vote period was not an execution timelock.
How it happened
- The attacker purchased just over half of TOP’s voting supply, created and executed an uncapped self-mint proposal, then sold the minted tokens to pull 944.24 WETH from the pool.
- The voting period was not an execution delay once the absolute majority was final.
Protocol details
Classification
Other / Governance
Protocol Type
Exploit/Access control
Implementation language
Solidity
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
