<h2 id="defi-security-news">DeFi Security News</h2>
<p>Term Finance lost an estimated $8.5 million on Aug. 23 after an attacker exploited the governance system of its strategy vaults, according to blockchain security firms PeckShield and CertiK.</p>
<p>PeckShield reported that approximately 2,843 Ethereum (ETH), worth around $6.87 million at the time, was drained from the vaults, along with 1.68 million USD Coin (USDC) that was converted into an equivalent amount of Dai (DAI). CertiK put the combined total at roughly $8.5 million.</p>
<p>Before the attack, Term's vaults held $12.45 million, according to DefiLlama data. The amount removed represented about 68% of that total, including nearly all of the vaults' $8.8 million in ETH deposits.</p>
<h2 id="how-the-attacker-gained-control">How the Attacker Gained Control</h2>
<p>On-chain monitoring service Defimon reported the attacker acquired a majority of a sparsely held governance token at low cost, then used that position to pass proposals giving it control over the vault contracts. Term Labs has not confirmed which governance functions were used or the exact method by which voting control was obtained.</p>
<p>The vaults were built on Yearn V3 infrastructure. Yearn stated the exploit involved a custom governance wrapper specific to Term Finance and that standard Yearn vault setups are not exposed to the same attack vector.</p>
<p><strong>Related Article: <a href="https://coinmarketcap.com/academy/article/harmony-confirms-exploit-after-attacker-mints-4b-one-tokens" rel="noopener noreferrer">Harmony Confirms Exploit After Attacker Mints 4B ONE Token</a></strong></p>
<h2 id="term-closes-vaults-and-begins-recovery-effort">Term Closes Vaults and Begins Recovery Effort</h2>
<p>Term Labs said it permanently shut down all Term Meta Vaults following the incident and revoked their decentralized autonomous organization governance roles. Withdrawals remain open, but the protocol is no longer accepting new deposits into those products. Term said its core borrowing and lending markets were unaffected, though it was still assessing the full scope of the attack at the time of the statement.</p>
<p>The company said it is working with external security teams on asset recovery and will look into options for addressing any remaining shortfall. Cointelegraph was unable to reach Term Labs for comment.</p>
<p>This was not the first security incident Term has faced. In April 2025, an oracle error caused approximately 918 ETH in unintended liquidations. Term recovered 556 ETH, absorbed a final loss of 362 ETH, and reimbursed affected users. After that event, the protocol committed to third-party validation for critical updates and increased governance transparency.</p>

Term Finance Loses $8.5M After Attacker Seizes Vault Governance

Table of Contents

Other articles published on Aug 24, 2026

Join our free newsletter for daily crypto updates!