TOPBPool exploit analysis

A governance-controlled mint path on the project's Balancer pool let the project owner mint a large pool share count and exit it against the real USDC plus token reserves. The attacker was the project owner (or controlled the owner key), called the privileged mint function, then exitPool returned the inflated shares in USDC plus the underlying token.

DeFiHackLabs reconstructs the sequence against the live Ethereum state; the drain is in 0x967aa34c69b7775c718545c7f94d92e965eb5fc553c0f27f6f1a9c65c93ac156 on Etherscan for a total loss of about 944.20 WETH. TenArmorAlert and Defimon Alerts both reported the incident.

What would have prevented it: gating the privileged mint behind a minimum-delay timelock with a public veto window, so a single-key compromise cannot drain a Balancer pool in one transaction.