Token of Power DAO Drained in Single Transaction Without Timelock

Published by James Harris on June 9, 2026June 9, 2026

Governance attacks are usually slow. This one cleared majority control, passed a proposal, minted new tokens, and drained a liquidity pool in a single transaction.

The exploit against the Token of Power DAO followed a path that has become increasingly familiar since the Beanstalk hack in April 2022, where an attacker used a flash loan to acquire temporary governance majority and drain $182 million in a single block. TOP’s version was structurally simpler: the token supply was only 16,384 units, making a controlling stake cheap to accumulate over time rather than requiring a flash loan. The attacker held 8,192.000001 TOP, just over 50%, which was sufficient to pass proposals unilaterally through Aragon’s voting infrastructure. The critical failure was the absence of a timelock, the standard mechanism that introduces a delay between a proposal passing and its execution, giving other stakeholders a window to respond. Without it, proposal creation, voting, and execution collapsed into one atomic transaction, and the 944 WETH sitting in a Balancer V1 liquidity pool had no protection beyond the governance configuration that had already been compromised.

Balancer’s protocol was not exploited. The pool was simply where inflated TOP tokens were converted into something worth keeping.

The attacker funded the wallet through Tornado Cash before execution, which is now a routine operational step in sophisticated DeFi exploits and meaningfully complicates any recovery effort regardless of how traceable the WETH remains onchain. Neither the TOP team nor Aragon has issued a statement, which matters because Aragon’s own documentation explicitly flags token minting and fund movements as functions requiring restricted access controls. The gap between what the documentation recommends and what TOP’s deployment enforced is the entire story here. For any DAO running on Aragon or comparable governance infrastructure with a small token supply and meaningful treasury exposure, this incident is a direct prompt to audit timelock configurations, not a general cautionary tale.

The broader implication is for the long tail of small DAOs that launched governance infrastructure during 2021 and 2022 without sustained technical oversight afterward. Low-cap tokens with concentrated supply and live treasuries are a category of target, not isolated edge cases, and the cost of accumulating a controlling stake in many of them has only decreased as token prices have fallen from cycle highs. Security firms flagged this incident quickly, but detection after execution is not a defense.