An attacker exploited a governance misconfiguration in Token of Power's Aragon DAO on Tuesday to mint 10 billion TOP tokens, then swapped a fraction of that supply for 944.2 WETH worth roughly $1.58 million.
Security firm Blockaid identified the incident as a governance-takeover attack, distinct from a smart-contract coding flaw. The attacker first spent approximately 662 ETH, withdrawn from Tornado Cash, to acquire about 8,192 TOP tokens: just over 50% of the protocol's total supply of 16,384 tokens, giving them absolute majority control of the DAO. With that stake in hand, they submitted a governance proposal to mint 10 billion new tokens directly to an attacker-controlled contract.
The Aragon Voting app had no timelock, allowing the attacker to create the proposal, vote it through, and execute it in a single transaction. PeckShield confirmed the attacker then deposited 945.1 ETH into Tornado Cash after the drain.
The root vulnerability was architectural. Token of Power ran on an Aragon DAO using a MiniMeToken-based governance contract, infrastructure widely adopted during earlier phases of Ethereum's DAO ecosystem. Blockaid noted the Aragon Voting app permitted proposal creation, vote-casting, and execution in a single atomic transaction because no timelock gated any of those steps.
