Governance Attack Drains $1.5M from Balancer Pool

In a recent security incident, a governance takeover attack allowed an exploiter to mint 10 billion TOP tokens and drain roughly $1.5 million in WETH from a Balancer liquidity pool on Ethereum. Blockchain security firm Blockaid reported that the attacker drained 944.2 WETH, worth approximately $1.58 million, from the TOP/WETH Balancer V1 pool after exploiting a governance configuration linked to the Token of Power (TOP) ecosystem.

Researchers stressed that Balancer itself was not vulnerable. Instead, the exploit targeted the protocol’s governance architecture. According to Blockaid and CertiK, the attacker acquired more than 50% of TOP’s token supply before executing a governance proposal that minted billions of new TOP tokens directly to the attacker-controlled contract.

How the Attack Worked

The exploit reportedly relied on a misconfiguration in the Aragon DAO involving TOP’s MiniMeToken structure. Blockaid said the governance system allowed proposal creation, voting, and execution within a single transaction because no timelock protections were in place. The Aragon Voting app allowed create, vote, and execute in a single transaction with no timelock, according to Blockaid’s analysis.

CertiK separately reported that the attacker initially withdrew 662 ETH from Tornado Cash before accumulating enough TOP tokens to gain majority governance control. This allowed them to pass a malicious proposal that minted additional tokens and drained the liquidity pool.

Governance as an Attack Vector

The incident highlights how governance systems themselves can become attack surfaces in DeFi protocols. Unlike traditional smart contract exploits involving coding flaws or reentrancy attacks, governance takeovers weaponize administrative permissions and voting systems already embedded inside protocols.

Timelocks are commonly used in DAO systems to slow governance execution and give communities time to react to malicious proposals. In this case, researchers say the absence of execution delays allowed the exploit to unfold instantly.

Legacy Infrastructure Risks

The exploit also highlights risks associated with older DAO governance frameworks and legacy DeFi infrastructure still operating on Ethereum. Aragon and MiniMeToken-based governance systems were widely adopted during earlier phases of Ethereum’s DAO ecosystem. However, some deployments may no longer reflect modern governance security standards.

The incident adds to growing scrutiny of governance security as attackers increasingly target protocol control mechanisms rather than seeking only direct smart contract vulnerabilities. It serves as a reminder that even well-known platforms can be compromised through their governance systems if proper safeguards like timelocks are not implemented.

The post Governance Attack Drains $1.5M from Balancer Pool appeared first on TheCryptoUpdates.