Token of Power Hack
REPORTED LOSS
$1.6M
What happened
On June 9, 2026, an attacker acquired a voting majority in Token of Power, minted 10 billion TOP through Aragon governance, and sold the new tokens into a Balancer pool.
Technical Root Cause
A token-weighted Aragon DAO let a purchasable majority immediately execute an uncapped self-mint; the vote period was not an execution timelock.
Case & protocol details
Classification
Other / Governance
Protocol Type
Exploit/Access control
Implementation language
Solidity
How it happened
The attacker purchased just over half of TOP’s voting supply, created and executed an uncapped self-mint proposal, then sold the minted tokens to pull 944.24 WETH from the pool. The voting period was not an execution delay once the absolute majority was final.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report x.com
- report Report x.com
- report Report x.com
- report BlackHart forensic report blackhart.io
- report Token of Power contemporaneous report thecoinheadlines.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
