Token of Power Governance Attack Drains $1.58M From Balancer Pool

A governance attack on the Token of Power (TOP) protocol allowed an exploiter to mint 10 billion TOP tokens and drain 944.2 WETH — roughly $1.585 million — from a TOP/WETH $BAL Balancer V1 liquidity pool. Blockchain security firm Blockaid detected the exploit and flagged it on X, crediting its exploit detection system with identifying the attack. Weak governance safeguards and the absence of a timelock left the protocol exposed.

How the Attack Unfolded

The attacker first secured majority voting control over the Token of Power protocol, then used that position to push through a malicious governance proposal. With the proposal executed, the exploiter minted 10 billion TOP tokens — a volume large enough to overwhelm the pool's balance — and swapped them directly for WETH, pulling the Ethereum reserves out of the TOP/WETH Balancer V1 pool. The sequence was fast and, by the time Blockaid raised the alarm, the funds had moved.

Balancer Was the Venue, Not the Victim

Blockaid was explicit on this point: the exploit did not target any vulnerability in Balancer's smart contracts. The $BAL-adjacent pool was where the stolen funds were held, but the attack vector ran entirely through TOP's own governance layer. Balancer's infrastructure was not compromised; it was simply the exit ramp the attacker used once the protocol's own controls had been captured.

Governance Design Failures at the Root

Security analysts pointed to two structural weaknesses that made the attack possible. The protocol's governance safeguards were insufficient to prevent a single actor from accumulating controlling influence. More critically, TOP lacked a timelock — the delay mechanism that gives a protocol's community time to detect and block a malicious proposal before it executes. Without one, the window between proposal passage and fund drainage was effectively zero.

Governance attacks following this structure — acquire votes, pass a self-serving proposal, exit liquidity — have become a recurring pattern across decentralized finance. The Token of Power incident adds another entry to that ledger: $1.58 million removed, and no circuit breaker in place to slow it down.