TokenOfPower Loses $1.5 Million in Governance Exploit Targeting AragonDAO Flaw

A significant exploit targeting the TokenOfPower (TOP) token has resulted in losses of approximately $1.5 million, according to a report from blockchain security firm GoPlus. The incident, which unfolded on June 5, 2025, saw an attacker exploit a governance configuration error in the AragonDAO framework to mint an unauthorized 10 billion TOP tokens.

How the Exploit Unfolded

GoPlus, a prominent blockchain security firm, disclosed the attack on its official X account. The firm reported that the hacker, who already held over 50% of the TOP token supply, leveraged a structural flaw in AragonDAO’s governance system. This flaw allowed the attacker to bypass standard voting mechanisms and mint 10 billion TOP tokens without community approval. Following the mint, the hacker swapped 1 billion of these tokens for wETH, draining approximately 944.2 wETH from the project’s liquidity pools.

Technical Breakdown of the Vulnerability

The vulnerability stemmed from a governance configuration error within AragonDAO, a decentralized autonomous organization framework used by many DeFi projects. The specific flaw allowed a token holder with a majority stake to unilaterally execute administrative functions, including token minting. This type of governance attack, known as a ‘majority takeover,’ highlights the risks of centralized control in supposedly decentralized systems. The TOP token, an ERC-20 standard token, had no built-in safeguards to prevent such an abuse of power by a majority holder.

Implications for DeFi Security

This exploit underscores a critical vulnerability in many DeFi projects: governance systems that rely on token-weighted voting can be easily manipulated by large holders. The attack on TokenOfPower is a stark reminder that governance security must be multi-layered, including time locks, multi-signature requirements, and emergency pause mechanisms. For TOP token holders, the immediate impact is a significant dilution of their holdings, as the unauthorized minting increased the total supply by 10 billion tokens. The market price of TOP is expected to face severe downward pressure as a result.

Conclusion

The $1.5 million exploit of TokenOfPower serves as a cautionary tale for the DeFi industry. While the attacker was able to profit from a governance flaw, the incident highlights the ongoing need for robust security audits and more resilient governance frameworks. As blockchain security firms like GoPlus continue to monitor such threats, projects must prioritize governance security to protect their communities from similar attacks.

FAQs

Q1: What is TokenOfPower (TOP)?
TokenOfPower is an ERC-20 token used in a decentralized finance (DeFi) ecosystem. It is built on the Ethereum blockchain and is designed for governance and utility within its platform.

Q2: How did the hacker exploit the AragonDAO governance system?
The hacker, who already held over 50% of the TOP supply, exploited a configuration error in AragonDAO that allowed a majority holder to mint new tokens without a community vote. This structural flaw bypassed standard governance checks.

Q3: What should TOP token holders do?
Token holders should monitor official announcements from the TokenOfPower team for updates on potential recovery plans or security measures. They should also be cautious of phishing attempts and verify all communications through official channels.