An exploit incident on Tuesday, targeting the DeFi project Token of Power ($TOP), has resulted in the loss of over $1.5 million. The TOP token is an Ethereum-based ERC-20 asset managed by a Decentralized Autonomous Organization (DAO) called “The Mask of Power”. It was built around the collective ownership of a specific MetaMask NFT with its native token being put to use to generate liquidity.
A number of on-chain intelligence firms including Blockaid, PeckShield, and Cyvers flagged the exploit on X. While Blockaid described the incident as a “governance-takeover attack”, Cyvers noted that the funds were drained from the TOP/WETH Balancer V1 Pool.
The Balancer V1 liquidity pool can be explained as an automated trading vault that held a 50-50 mix of $TOP tokens and Wrapped Ethereum (WETH), a tradeable version of the standard ETH token.
On-chain intelligence firms say that to execute the attack, the attacker minted billions of new, worthless TOP tokens into the vault and seapped them for the real tokens inside.
A total of 944.2 WETH worth $1.58 million have been drained from the vault — leaving investors with worthless tokens.
PeckShield data showed the attacker has deposited the stolen tokens into the Tornado Cash crypto mixer to break the trace to the stolen tokens.
More details about the attack remains awaited for now.
The exploit comes a day after blockchain-based digital identity project Humanity Protocol was breached for $36 million in user funds via an employee’s laptop.
