Attacker acquired >50% voting power of TOP token via Balancer pool and passed malicious governance proposal to mint massive tokens, draining $1.58M WETH from Balancer V1 pool. Vulnerability stemmed from extremely low token supply (16,384 TOP total).

Token of Power (TOP) suffered a governance takeover exploit due to misconfiguration in its Aragon DAO (no timelock). The attacker used funds from Tornado Cash to acquire majority voting power (>50% of the small 16,384 TOP supply), passed a malicious proposal in a single transaction to mint billions of new TOP tokens, and drained 944.2 WETH (~$1.58M) from the TOP/WETH Balancer V1 liquidity pool. Balancer protocol itself was not exploited.