A security breach on Tuesday resulted in over $1.5 million being siphoned from a liquidity pool associated with Token of Power. On-chain monitoring firms Blockaid, PeckShield, and Cyvers promptly alerted the community via social media posts.
The attack targeted the TOP/WETH Balancer V1 pool, leading to the loss of 944.2 WETH, valued at approximately $1.58 million. Blockaid categorized it as a governance-takeover attack, while Cyvers confirmed that the funds were drained directly from the Balancer pool.
According to PeckShield, the attacker later funneled the stolen cryptocurrency into Tornado Cash, a mixing service that complicates transaction tracking. This incident highlights persistent risks in decentralized finance, even for protocols that have undergone audits.
Token of Power operates as an Ethereum-based ERC-20 token under a decentralized autonomous organization named The Mask of Power. Its liquidity pool utilized a 50-50 ratio between TOP tokens and Wrapped Ethereum to facilitate automated trading.
The exploit method involved the attacker injecting a massive number of TOP tokens into the pool and swapping them against the legitimate WETH reserves, effectively draining the WETH. Following the drain, the pool held significantly devalued TOP tokens, leaving liquidity providers with near-worthless assets.
This breach occurred just one day after another major DeFi incident, where Humanity Protocol lost $36 million due to compromised admin keys. While the two attacks differ in nature, both underscore ongoing security challenges within the blockchain ecosystem.
As of now, Token of Power has not released details about potential recovery plans or compensation for affected users. Blockchain security firms continue to investigate the incident, and further technical insights are expected soon.