Token of Power hack — June 2026

Token of Power (TOP) was a small Ethereum ERC-20 with a total supply of 16,384 tokens, governed through an Aragon DAO in which voting weight was simply proportional to holdings. The DAO had no timelock, so a proposal could be created, voted through and executed inside a single transaction, and its TokenManager could mint new supply.

According to TRM Labs, on 9 June 2026 the attacker funded the operation with roughly 664 ETH, about $2.7 million at the time, withdrawn from Tornado Cash. It bought TOP on the open market until it held 8,192.000001 tokens, just over half of supply, then submitted a proposal instructing the TokenManager to mint 10 billion TOP to a contract it controlled, voted it through with its own majority and executed it in the same block.

The newly minted tokens were sold into the 50/50 TOP/WETH pool on Balancer V1, which had no defence against a counterparty able to create supply at will. The attacker took 944.2 WETH, about $1.585 million, leaving the pool holding heavily diluted TOP of negligible value. The loss fell on the pool's liquidity providers. PeckShield reported 945.1 ETH being routed back into Tornado Cash afterwards.

The incident was flagged on-chain by Blockaid, with BlockSec Phalcon confirming the attack sequence, and PeckShield and Cyvers also reporting it. TRM Labs published a separate analysis and did not attribute the attack to any named actor, describing its proceeds as roughly $1.6 million, consistent with the 944.2 WETH figure. No recovery, compensation plan or project statement has been reported.