Term Finance loses $8.5M as governance attack drains Ethereum vaults

Term Finance lost $8.5 million on Aug. 23 after an attacker seized governance control of its Ethereum vaults, draining 2,843 ETH and 1.68 million USDC.

PeckShield traced the attacker's initial funding to 2 ETH routed through Tornado Cash, while CertiK identified the receiving wallet as 0xD5183d8BfC65a50863C62aF2538198A8288FFc13, which now holds roughly 2,843 ETH and 1.6 million DAI.

The attacker accumulated enough TERM governance tokens to command about 91 percent of the Ethereum Meta Vault and full control of four USDC strategy vaults, then submitted and passed proposals directing those vaults to pay out to a single address. The stolen USDC was subsequently swapped for approximately 1.6 million DAI, according to PeckShield. Term Labs confirmed the exploit on its official channels and said the matter remains under investigation.

The breach marks the second major loss for Term Finance, which recovered about $1.5 million after a May 2025 oracle decimal error. Recovery this time looks harder: the attacker pre-funded the operation through Tornado Cash, and Term Labs has not yet published a technical postmortem or reimbursement plan.

Governance, not code, was the vulnerability

The exploit targeted Term Vaults, which are built on Yearn v3 contracts and interact with external DeFi protocols, rather than Term Finance's core repo lending architecture. That repo structure uses dedicated collateral lockers designed to isolate borrower and lender exposure. The vault layer, by contrast, runs on a governance-driven voting mechanism — and that mechanism is what the attacker learned to game.

No contract was broken and no audited line of code failed. The vulnerability sat at the intersection of governance design, low voter turnout, and insufficient guardrails on who could accumulate decision-making power over vault operations. The attack did not compromise the Ethereum blockchain or the USDC protocol itself.

Ethereum DeFi bleeds as 2026 losses top $1 billion

The Term Finance drain adds to a brutal year for Ethereum DeFi security. A Blockaid report covering the first half of 2026 found crypto theft and fraud losses exceeded $1 billion, with Ethereum accounting for the largest share at roughly $332 million, driven largely by smart contract and application-layer exploits.

The Verus-Ethereum Bridge was hit for the second time in July, with attackers draining approximately $7.54 million after a similar $11.58 million theft in May. Governance takeovers have also spread beyond Ethereum: BonkDAO lost roughly $20 million in July after an attacker passed a malicious proposal through Solana's Realms system, and the small Ethereum-based TOP protocol lost about $1.6 million in June after an attacker bought a majority of its token supply.

ETH was trading around $2,412 at press time, down 48.9 percent over the past year after starting 2026 near $4,000. The repeated security failures have compounded pressure from regulatory uncertainty and broader market weakness.

This article is for informational purposes only and does not constitute investment advice.