DeFi

Tornado

BarnBridge

Ethereum Meta

USDC

<p>An attacker drained $8.5 million from Term Finance’s lending vaults on August 23 by taking over the DeFi protocol’s own governance vote, not by exploiting a flaw in its code.</p>
<ul>
 <li>The attacker seized majority control of Term’s governance vote, then withdrew 2,843 ETH and 1.68 million USDC, worth about $8.5 million combined.</li>
 <li>The attack wallet was funded with 2 ETH routed through Tornado Cash, and the stolen USDC was swapped into a similar amount of DAI.</li>
 <li>It is the fourth governance takeover to hit a DeFi protocol since early June, matching a pattern the security firm Blockaid had already documented in three earlier attacks.</li>
</ul>
<h2 id="why-it-matters">Why It Matters</h2>
<p>Term’s governance token trades on thin liquidity, and the attacker used that to build a majority stake cheaply, then passed a proposal handing itself control of the protocol’s vaults. By the time Term Labs, the company behind the protocol, caught it, the attacker held all four of Term’s five USDC strategy vaults and about 91% of its Ethereum Meta Vault.</p>
<p>From there, the attacker withdrew the ETH and USDC. The wallet, <a href="https://etherscan.io/address/0xD5183d8BfC65a50863C62aF2538198A8288FFc13" rel="noopener noreferrer nofollow">identified by the security firm CertiK</a>, had been funded with just 2 ETH from Tornado Cash, the mixing service commonly used to obscure where stolen funds move next.</p>
<h2 id="the-same-playbook-four-times-since-june">The Same Playbook, Four Times Since June</h2>
<p>Term Finance is not the first protocol to fall this way this summer. <a href="https://blockaid.io/blog/governance-takeovers-how-22m-was-drained-and-how-to-stop-them" rel="noopener noreferrer nofollow">Blockaid tallied about $22 million in losses across seven protocols</a> hit by governance takeovers between June 9 and August 6, and detailed three of them by name: an Aragon-based project called Token of Power lost $1.59 million on June 9, the Solana rewards platform BonkDAO lost about $20 million on July 6 after an attacker spent $4.4 million buying voting tokens, and BarnBridge lost $777,000 on July 15 to an attacker whose entire voting position cost around $600.</p>
<p>In each case, Blockaid found the same underlying weaknesses: voting thresholds set too low, no timelock between a proposal passing and taking effect, and governance systems wired directly into powers strong enough to move user funds. Term’s own vault-control numbers match that description closely.</p>
<h2 id="what-term-labs-has-said">What Term Labs Has Said</h2>
<p>Term Labs acknowledged the exploit in a statement, saying only that it was</p>
<blockquote>
 <p>aware of a governance exploit impacting Term vaults</p>
</blockquote>
<p>and would share more details once its investigation was further along. The company has not said whether it plans to compensate affected users or change how voting power translates into control of its vaults.</p>
<p>Until then, Term Finance sits alongside three other protocols that lost money this summer to a failure mode security researchers had already described in detail.</p>

Term Finance Lost $8.5M to a Governance Attack Playbook

Table of Contents

CRYIP

Other articles published on Aug 23, 2026

Join our free newsletter for daily crypto updates!