Attacker drains $1.58M from Token of Power pool via Aragon DAO governance exploit

Crypto Insight Summary: An attacker exploited a governance misconfiguration in the Token of Power (TOP) Aragon DAO, draining approximately 944.2 WETH (around $1.58 million) from a Balancer V1 liquidity pool on Ethereum. TOP operates as a MiniMeToken with a total supply of just 16,384 tokens, and the attacker accumulated 8,192.000001 TOP—slightly more than 50%—giving them unilateral control over governance proposals. Because the Aragon Voting app lacked a timelock, the attacker could create, vote on, and execute a proposal within a single transaction, minting a large quantity of new TOP tokens to their address. Those minted tokens were then swapped into WETH through the TOP/WETH Balancer V1 BPool, though Balancer's protocol itself was not compromised. The attacker's wallet (0xff8eF7bC455a57e5893233052Ce0232b39Fa2) was funded through Tornado Cash, and the exploit was carried out in a single transaction via a dedicated contract, according to Blockaid and BlockSec Phalcon. The incident highlights how small token supplies and low market capitalizations make governance takeovers cheap, especially when timelocks, quorum delays, or proposal cooldowns are absent. Neither the Token of Power team nor Aragon had issued a statement as of publication, and recovery prospects are complicated by the Tornado Cash funding source. The stolen WETH remains traceable onchain, but the attacker's use of a mixing service reduces the likelihood of restitution. The case underscores that governance safeguards such as timelocks and quorum thresholds are critical for low-supply tokens with meaningful treasury exposure. Crypto Insight Analysis: Direction: Bearish TOP / Neutral ETH / Neutral BAL Impact: Minor Impact Horizon: Short-term (1-3 days) Reasoning: Governance exploit affects TOP token's credibility, but limited market cap means broader market impact is minimal.