Incident Overview
On June 9, 2026, the Token of Power ($TOP) protocol suffered a hostile governance takeover exploit on Ethereum, resulting in a net liquidity drain of 281 ETH (~$472,000).
The exploit was not driven by a smart contract bug or access-control failure, but rather by a structural vulnerability in the system's token-weighted governance topology. The protocol featured a micro-supply of only 16,384 $TOP tokens, with roughly 91% concentrated inside its own Balancer V1 liquidity pool. To orchestrate the attack, a fresh wallet funded with 662 ETH via Tornado Cash purchased 8,192.000001 $TOP from the pool, claiming an instant >50% voting majority.
The protocol utilized Aragon governance structures where an active vote immediately executes early if a single entity passes the absolute majority threshold, bypassing the native 30-day voteTime barrier. In a single atomic transaction, the attacker called forward() to trigger a newVote(), cast a winning ballot, and early-executed a malicious payload calling generateTokens. This action minted 10 billion unbacked $TOP tokens directly to their contract.
The attacker then dumped the newly minted tokens back into the Balancer pool to extract a gross output of 944 ETH. After discounting the initial 662 ETH buy-in, the net extraction from the protocol's treasury totaled ~281 ETH.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Token of Power, these are the critical security checks that could have prevented this incident (June 2026).
- Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Token of Power
The Token of Power hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.