Zodiac

Gnosis

Tornado Cash

Yearn

<h2 id="b-tldr-b">TLDR:</h2><ul><li style="font-weight: 400">Term Labs confirmed a governance exploit that security firms estimate drained roughly $8.5M from its vaults.</li><li style="font-weight: 400">PeckShield traced 2,843 ETH worth about $6.87M and 1.68M USDC, later swapped into roughly 1.68M DAI.</li><li style="font-weight: 400">Term’s vault governance uses a Gnosis Safe, Zodiac Delay Module and seven-day timelock with DAO veto rights.</li><li style="font-weight: 400">DeFiLlama showed $10.87M in TermFinance Vault TVL before the exploit, including about $7.23M on Ethereum.</li></ul>Term Labs is investigating a governance exploit that security firms estimate drained about $8.5 million from Term Finance vaults on Aug. 23. The incident shifted attention from <a href="https://blockonomi.com/how-smart-contract-security-improvements-are-strengthening-online-game-platforms/" rel="noopener noreferrer nofollow">smart-contract</a> code toward the governance controls protecting the protocol’s vaults and assets.CertiK <a href="https://twstalker.com/CertiKAlert?" rel="noopener noreferrer nofollow">identified</a> an attacker-controlled address holding about 2,843 ETH and roughly $1.6 million in DAI after the exploit. PeckShield estimated the attacker removed 2,843 ETH, worth about $6.87 million, alongside 1.68 million USDC from the affected system.<div class="embed-x"><blockquote class="twitter-tweet">Term Labs Suffers $8.5M Governance Exploit Affecting VaultsDeFi lending protocol <a href="https://x.com/term_labs?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@term_labs</a> suffered a governance exploit affecting its vaults. According to PeckShieldAlert and CertiK Alert, the attack resulted in losses of about $8.5 million, with the exploiter holding… <a href="https://t.co/yhAHbCN95d" rel="noopener noreferrer nofollow">pic.twitter.com/yhAHbCN95d</a>— Wu Blockchain (@WuBlockchain) <a href="https://x.com/WuBlockchain/status/2091475193277394977?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">August 23, 2026</a></blockquote></div>The USDC was later exchanged for roughly 1.68 million DAI, while the attack was initially funded with 2 ETH from <a href="https://blockonomi.com/tornado-cash-phishing-attack-drains-1010-eth-through-expired-domain/" rel="noopener noreferrer nofollow">Tornado Cash</a>. Term Labs confirmed that a governance exploit affected its vaults, but it had not released a complete postmortem by Aug. 23.Consequently, the attack sequence, affected vaults, and method used to defeat governance protections remained unconfirmed.<h2 id="b-term-vault-governance-controls-face-scrutiny-after-8-5m-exploit-b">Term Vault Governance Controls Face Scrutiny After $8.5M Exploit</h2>The incident differs from a conventional contract failure as early security reports identify governance as the apparent route to vault assets. That distinction places Term Finance’s control structure under examination as investigators determine how the attacker reached protected funds.Term’s documentation assigns separate manager sand governor roles, with governance actions passing through a <a href="https://moneycheck.com/gnosis-commits-to-complete-user-reimbursement-following-gnosis-pay-security-incident/" rel="noopener noreferrer nofollow">Gnosis Safe</a> and Zodiac Delay Module. Those actions also face a seven-day timelock before execution, creating a window for changes to be reviewed.Vault liquidity providers are described as DAO participants with authority to veto proposals during that delay. According to the <a href="https://developers.term.finance/periphery-contracts/curated-vaults/administration/term-vault-governance?" rel="noopener noreferrer nofollow">documentation</a>, a successful veto can invalidate a queued transaction before execution, adding protection.However, Term Labs had not confirmed whether voting influence, a permissions issue, configuration failure, or another governance path caused the breach. Without that postmortem, evidence does not establish which safeguard failed or whether the documented controls operated as designed.<h2 id="b-vault-design-tvl-and-recovery-questions-remain-unresolved-b">Vault Design, TVL and Recovery Questions Remain Unresolved</h2>Term Finance <a href="https://docs.term.finance/" rel="noopener noreferrer nofollow">provides</a> non-custodial, fixed-rate, overcollateralized lending modeled on traditional repurchase agreements and matches borrowers with lenders through sealed-bid auctions. Lenders receive repo tokens representing principal and interest claims at maturity, while Strategy Vaults automate participation and liquidity management.The vaults use Yearn V3’s ERC-4626 infrastructure alongside custom logic for auctions, portfolio limits, reserves, and maturity controls. Therefore, evidence does not establish a vulnerability in Yearn V3 or <a href="https://coincentral.com/2-6-billion-floods-into-bitcoin-and-ethereum-etfs-in-best-week-since-october-2025/" rel="noopener noreferrer nofollow">Ethereum</a>.Instead, scrutiny remains focused on the permissions and governance layer surrounding Term’s vault implementation. Before the exploit, <a href="https://defillama.com/protocol/termfinance-vaults?" rel="noopener noreferrer nofollow">DeFiLlama listed</a> TermFinance Vaults with about $10.87 million in TVL, including $7.23 million on Ethereum.However, that figure excludes capital deployed into Term repo tokens to prevent double-counting, making comparison with the $8.5 million estimate unreliable. Term Labs had not announced a recovery plan, reimbursement framework, or confirmed total user losses at the time of writing.It also had not disclosed whether deposits, withdrawals, governance functions, or specific vaults had been paused after the incident. The attacker-controlled wallet remains a tracing focus, although <a href="https://parameter.io/multisig-wallet-drainer-launders-millions-in-eth-via-tornado-cash/" rel="noopener noreferrer nofollow">Tornado Cash</a> funding alone does not identify the attacker.For depositors, the next disclosures must clarify the malicious governance transactions, affected contracts, proposal timing, and timelock activity. Those details will determine whether the incident involved governance capture, faulty permissions, or another implementation failure within Term Finance’s vault controls.The post <a href="https://blockonomi.com/term-labs-loses-8-5m-in-governance-exploit-as-vault-security-faces-scrutiny/" rel="noopener noreferrer nofollow">Term Labs Loses $8.5M in Governance Exploit as Vault Security Faces Scrutiny</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Term Labs Loses $8.5M in Governance Exploit as Vault Security Faces Scrutiny

Table of Contents

Blockonomi

Other articles published on Aug 23, 2026

SEC Token Project Securities Lifecycle Policy Could Reshape Crypto Compliance

Canada to Impose Matching Tariffs on U.S. Goods Starting Sept. 8

KiiChain Halts Network After EVM Exploit Moves Funds Through Hyperlane to BSC

Shiba Inu Faces Selling Pressure as Exchange Inflows Outpace Withdrawals

Volante Integration Brings XRP Support to FedNow Payment Network

Why Owning Crypto ETFs Doesn’t Make Lawmakers Pro-Crypto

Join our free newsletter for daily crypto updates!