Zilliqa

Based

Yearn

Decentralized lending protocol Term Finance lost an estimated $8.5 million after an attacker exploited governance control of its strategy vaults, according to blockchain security firms.&nbsp;
On Sunday, PeckShield <a href="https://x.com/PeckShieldAlert/status/2091452165932175659" rel="noopener noreferrer nofollow">said</a> the attacker drained about 2,843 Ether (ETH), valued at $6.87 million at the time, and 1.68 million USDC, which was exchanged for approximately 1.68 million Dai (DAI). CertiK made a similar<a href="https://x.com/CertiKAlert/status/2091433962795106499" rel="noopener noreferrer nofollow"> estimate</a>, placing the total loss at around $8.5 million.&nbsp;
The reported loss represented about 68% of the $12.45 million held in Term’s vault product before the attack, including nearly all of its approximately $8.8 million in Ethereum deposits, <a href="https://defillama.com/protocol/termfinance-vaults" rel="noopener noreferrer nofollow">according</a> to DefiLlama data.&nbsp;
Term Labs <a href="https://x.com/term_labs/status/2091667425129304215" rel="noopener noreferrer nofollow">said</a> it had irreversibly shut down all Term Meta Vaults and revoked their DAO governance roles, preventing further deposits while keeping withdrawals open. Its investigation so far found the underlying Term protocol and its direct borrowing and lending markets were unaffected, though it was still verifying the scope.&nbsp;
Cointelegraph was unable to reach Term Labs for comment.
<h2 id="attacker-allegedly-took-control-through-governance">Attacker allegedly took control through governance</h2>
Onchain monitoring service Defimon <a href="https://x.com/DefimonAlerts/status/2091422624249217259" rel="noopener noreferrer nofollow">said</a> the attacker cheaply acquired a majority of a sparsely held governance token and passed proposals that allowed it to seize control of Term’s vaults. Term has not confirmed how the attacker obtained voting control or which governance functions were used.&nbsp;
The vault contracts use Yearn V3 infrastructure. However, Yearn <a href="https://x.com/yearnfi/status/2091599858323075144" rel="noopener noreferrer nofollow">said</a> the attack involved a custom governance wrapper and the attack vector does not apply to standard Yearn vault setups.&nbsp;
Related: <a href="https://cointelegraph.com/news/zilliqa-zil-deposit-halt-exchange-partner-wallet-breach" rel="noopener noreferrer nofollow">Zilliqa asks exchanges to pause ZIL transfers after suspected cold wallet theft</a>
Term said it was coordinating with external security teams on asset recovery and remediation. It said it would “explore paths to address” any remaining shortfall.
The incident follows an April 2025 oracle error that triggered about 918 ETH in unintended liquidations. At the time, Term recovered about 556 ETH, reduced its final loss to 362 ETH and reimbursed affected users, <a href="https://www.term.finance/post/tethpostmortem" rel="noopener noreferrer nofollow">according</a> to its postmortem. Following the incident, Term pledged third-party validation for critical updates and greater governance transparency.&nbsp;
Magazine: <a href="https://cointelegraph.com/magazine/mica-cracks-down-on-usdt-in-europe-but-global-demand-remains-high" rel="noopener noreferrer nofollow">MiCA cracks down on USDT in Europe... but no one else cares</a>

Term Finance loses estimated $8.5M in vault governance exploit

Table of Contents

Cointelegraph

Other articles published on Aug 24, 2026

Join our free newsletter for daily crypto updates!