Term Finance Suffers $8.5 Million Loss in Governance Exploitation Attack

Decentralized lending protocol Term Finance has experienced a significant financial setback, losing an estimated $8.5 million after an attacker successfully exploited the governance control of its strategy vaults. Blockchain security firms have confirmed the breach, which drained substantial amounts of Ether (ETH) and USDC, a stablecoin.

According to an alert issued by PeckShield on Sunday, the attacker managed to drain approximately 2,843 Ether, valued at $6.87 million at the time of the incident. In addition to the ETH, the attacker also acquired 1.68 million USDC, which was subsequently exchanged for approximately 1.68 million Dai (DAI), another stablecoin. CertiK, another prominent blockchain security firm, corroborated these findings with a similar estimate, placing the total loss at around $8.5 million.

The financial impact of this exploit is substantial, representing roughly 68% of the total assets held within Term Finance’s vault product prior to the attack. Defillama data indicates that before the exploit, the vaults contained $12.45 million. Of this amount, nearly all of its approximately $8.8 million in Ethereum deposits were compromised.

In response to the exploit, Term Labs announced that it had taken immediate action to secure the protocol. The company stated that it had irreversibly shut down all Term Meta Vaults and revoked the governance roles of the Decentralized Autonomous Organization (DAO) associated with these vaults. This decisive action aims to permanently prevent any further deposits into these compromised vaults, while crucially maintaining withdrawal functionalities for legitimate users.

Term Labs has initiated an investigation into the incident. Based on its preliminary findings, the company reported that the underlying Term protocol itself, along with its direct borrowing and lending markets, remained unaffected by the exploit. However, the company emphasized that it was still in the process of verifying the full scope of the impact.

Cointelegraph attempted to reach Term Labs for comment on the situation. However, the company does not publicly list a press contact, and its direct messaging feature on the X platform was closed, hindering direct communication.

Attacker Allegedly Seized Control Through Governance Mechanisms

Onchain monitoring service Defimon provided insights into the method of the attack, suggesting that the perpetrator achieved control by cheaply acquiring a majority of a sparsely held governance token. This enabled the attacker to pass proposals that ultimately granted them the ability to seize control of Term Finance’s vaults. While Defimon’s analysis points to this method, Term Finance has not yet officially confirmed how the attacker obtained voting control or which specific governance functions were exploited.

The vault contracts in question utilize Yearn V3 infrastructure. However, Yearn has clarified that the exploit was not a direct vulnerability within their standard vault setups. In a statement, Yearn indicated that the attack involved a custom governance wrapper, and thus, the attack vector is not applicable to standard Yearn vault configurations. This distinction suggests that the exploit was specific to Term Finance’s implementation and its interaction with Yearn’s infrastructure.

This incident follows a previous security concern for Term Finance. In April 2025, an oracle error led to approximately 918 ETH in unintended liquidations. At that time, Term Finance managed to recover about 556 ETH, reducing its final loss to 362 ETH and subsequently reimbursing the affected users, according to a postmortem report published by the company. Following that incident, Term Finance had pledged to implement third-party validation for critical updates and enhance governance transparency to prevent future occurrences.

Term Finance has stated that it is actively coordinating with external security teams to facilitate asset recovery and implement remediation measures. The company has also indicated that it will "explore paths to address" any remaining shortfall that may arise from the exploit. The ongoing investigation and recovery efforts are critical for rebuilding trust and ensuring the stability of the protocol.

The news of this exploit highlights the persistent security challenges within the decentralized finance (DeFi) sector, particularly concerning the complexities of governance mechanisms and the potential for attackers to exploit vulnerabilities in smart contract interactions. The DeFi community continues to grapple with finding robust and secure solutions to protect user assets and maintain the integrity of these innovative financial systems.