Maya Protocol

Maya

Tornado Cash

Ethereum

Term Labs has lost an estimated $8.5 million after an attacker gained enough governance power to execute malicious proposals against vaults operated by the Ethereum-based fixed-rate lending protocol.
Term Labs <a href="https://twstalker.com/CertiKAlert?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">confirmed the governance exploit</a> on Sunday and began investigating the affected vaults. The attacker-controlled address now holds approximately 2,843 ETH and 1.6 million DAI, placing the observed proceeds near $8.5 million at current prices.
Wallets connected to the operation were funded through <a href="https://cryptoadventure.com/tornado-cash-explained/" rel="noopener noreferrer nofollow">Tornado Cash</a> before the attacker accumulated governance voting power. The attack then used Term’s voting process to authorize transactions against protocol vaults, turning control of <a href="https://cryptoadventure.com/community/articles/what-is-web3-governance/" rel="noopener noreferrer nofollow">governance</a> into control over deposited assets rather than exploiting Ethereum itself.
<h2 id="attacker-used-governance-to-reach-term-vault-assets">Attacker Used Governance to Reach Term Vault Assets</h2>
TERM is the governance token for Term Finance, with token holders able to participate in decisions affecting the protocol. Term operates fixed-rate lending markets and vault products that deploy capital across onchain lending strategies.
The <a href="https://cryptoadventure.com/governance-attack-paths-explained-delegation-capture-parameter-risk-and-emergency-powers/" rel="noopener noreferrer nofollow">attack targeted the governance path</a> controlling Term vaults. The attacker accumulated voting power, submitted proposals capable of moving vault assets and secured enough support for the transactions to execute.
The stolen assets included roughly 2,843 ETH alongside stablecoins. About 1.68 million USDC was moved during the attack and subsequently converted into DAI, leaving the identified address with approximately 1.6 million DAI alongside the ETH.
The use of acquired voting power separates the Term drain from contract-level attacks such as Sunday’s <a href="https://cryptoadventure.com/kiichain-halts-network-after-evm-exploit-moves-funds-through-hyperlane-to-bsc/?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">KiiChain exploit</a>, where an EVM-module vulnerability allowed funds to leave the chain through Hyperlane before validators halted the network.
<h2 id="bonk-lost-20m-through-another-governance-capture">BONK Lost $20M Through Another Governance Capture</h2>
BonkDAO lost roughly $20 million in BONK on July 6 after an attacker accumulated enough voting power to pass a <a href="https://cryptoadventure.com/bonkdao-says-malicious-governance-proposal-drained-20m-treasury/?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">malicious proposal</a> through Solana’s Realms governance system.
The attacker spent about $4 million building the required BONK position before a proposal transferred 4.426 trillion BONK from the DAO treasury. BONK subsequently <a href="https://cryptoadventure.com/bonk-slides-nearly-40-after-20m-bonkdao-governance-attack/?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">fell nearly 40%</a> as the stolen tokens moved through the market.
A similar takeover hit the small Ethereum-based TOP protocol in June. An attacker withdrew about 664 ETH from Tornado Cash, bought more than half of TOP’s 16,384-token supply and used that majority to approve a mint of 10 billion new tokens. Roughly $1.6 million was extracted from a Balancer pool after the newly created supply was sold. <a href="https://www.trmlabs.com/resources/blog/the-top-takeover-tornado-cashs-latest-chapter?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">The governance majority</a> could execute immediately because TOP lacked a timelock between approval and execution.
<h2 id="term-investigates-as-defi-exploits-accelerate">Term Investigates as DeFi Exploits Accelerate</h2>
The $8.5 million Term drain comes days after Maya Protocol lost roughly $1.7 million when faulty accounting allowed an attacker to manipulate liquidity positions and extract assets. Maya responded with a <a href="https://cryptoadventure.com/maya-protocol-halts-network-after-1-7m-exploit-drains-20-btc/?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">network halt</a> while developers isolated the affected path.
Term has not published a final transaction-by-transaction postmortem, recovery plan or confirmed reimbursement process. Its latest update places the affected Term vaults under active investigation, while the identified attacker address continues to hold approximately 2,843 ETH and 1.6 million DAI.
The post <a href="https://cryptoadventure.com/term-labs-loses-8-5m-as-governance-exploit-drains-ethereum-vaults/" rel="noopener noreferrer nofollow">Term Labs Loses $8.5M as Governance Exploit Drains Ethereum Vaults</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Term Labs Loses $8.5M as Governance Exploit Drains Ethereum Vaults

Table of Contents

Crypto Adventure

Other articles published on Aug 23, 2026

Join our free newsletter for daily crypto updates!