preferred on
Points of Focus
- Term Labs lost an estimated $8.5M in a governance exploit.
- Attacker drained 2,843 ETH and $1.68M USDC from vaults.
- Exploit reportedly gained near-total control over multiple strategy vaults.
Term Labs, the developer behind fixed-rate lending protocol Term Finance, has suffered an estimated $8.5 million governance exploit, with an attacker draining thousands of ETH and $1.68 million in USDC from its vault infrastructure.
Term Labs confirmed on Aug. 23 that a governance exploit had affected Term Vaults, saying it was investigating and would release further details. The protocol has not yet published a technical postmortem identifying the exact governance function or permission path used.
Blockchain security firm PeckShield tracked approximately 2,843 ETH, worth $6.87 million at the time, and 1.68 million USDC leaving the affected vaults. The attacker subsequently converted the USDC into roughly 1.68 million DAI. PeckShield also traced the wallet’s initial funding to 2 ETH from Tornado Cash.
#PeckShieldAlert @term_labs was exploited for ~$8.5M due to a governance exploit impacting Term vaults.
The exploiter has drained ~2,843 $ETH ($6.87M) & 1.68M USDC ($1.68M) – which has already been swapped for ~1.68M $DAI
The exploiter originally funded with 2 ETH from… pic.twitter.com/6ZRoDD9QK7
— PeckShieldAlert (@PeckShieldAlert) August 23, 2026
CertiK independently estimated losses at around $8.5 million and tracked 2,843 ETH and approximately $1.6 million DAI to an address beginning 0xD5183.
Attacker reportedly seized near-total voting control
Early analysis suggests the incident was not a conventional smart-contract exploit.
Reports citing onchain analysis indicate the attacker accumulated enough voting power to obtain 100% control over four USDC strategy vaults and roughly 91% control of an Ethereum Meta Vault, before using that authority to redirect assets. Term Labs has not yet independently confirmed those percentages.
That mechanism is notable because Term’s own documentation describes several safeguards around vault governance.
Term Strategy Vaults are built using Yearn V3’s ERC-4626 architecture and automate lending across Term’s fixed-rate markets and external variable-rate protocols.
Its documented governance design uses a Gnosis Safe and seven-day timelock, with vault LP holders able to veto proposed governance actions before execution. The governor role can alter risk parameters, integrations and emergency controls.
How the attacker gained sufficient control, and whether the seven-day review and veto structure functioned as intended, remains unanswered pending Term Labs’ investigation.
$8.5M drain hits vaults with $12.2M TVL
The size of the loss is substantial relative to the affected product.
DefiLlama data cited following the attack put Term Vaults’ total value locked at approximately $12.2 million, including about $8.6 million on Ethereum.
Term Finance’s core product is fixed-rate, overcollateralized lending conducted through onchain auctions. The vault product was introduced in 2025 to automate those strategies, allowing deposited capital to be reallocated without users manually participating in individual auctions.
Term Finance suffered another loss in 2025
The incident marks the second major security-related loss associated with Term Finance.
In April 2025, an incorrect decimal configuration in a tETH oracle update caused unintended liquidations affecting 18 users. Term initially reported roughly 918 ETH in affected liquidations and later said remediation reduced its final absorbed loss to 164.5 ETH, with affected users fully reimbursed.
The latest incident is different: Term describes it specifically as a governance exploit involving its vaults rather than an oracle configuration failure.
For depositors, the biggest unanswered questions are now how voting control was accumulated, which safeguards failed to stop the withdrawal, whether any funds can be recovered and whether Term Labs will reimburse affected vault users. The protocol has yet to announce a recovery or compensation plan.
Share
Most read articles
