Term finance loses estimated $8.5M in vault governance exploit

Decentralized lending protocol Term Finance lost an estimated $8.5 million after an attacker exploited governance control of its strategy vaults, according to blockchain security firms. 

On Sunday, PeckShield said the attacker drained about 2,843 Ether (ETH), valued at $6.87 million at the time, and 1.68 million USDC, which was exchanged for approximately 1.68 million Dai (DAI). CertiK made a similar estimate, placing the total loss at around $8.5 million. 

The reported loss represented about 68% of the $12.45 million held in Term’s vault product before the attack, including nearly all of its approximately $8.8 million in Ethereum deposits, according to Defillama data. 

Term Labs said it had irreversibly shut down all Term Meta Vaults and revoked their DAO governance roles, permanently preventing further deposits while keeping withdrawals open. Based on its investigation so far, the company said the underlying Term protocol and its direct borrowing and lending markets were unaffected, though it was still verifying the scope. 

Cointelegraph was unable to reach Term Labs for comment. The company does not list a public press contact, and its direct messages on X were closed. 

Attacker allegedly took control through governance

Onchain monitoring service Defimon said the attacker cheaply acquired a majority of a sparsely held governance token and passed proposals that allowed it to seize control of Term’s vaults. Term has not confirmed how the attacker obtained voting control or which governance functions were used. 

The vault contracts use Yearn V3 infrastructure. However, Yearn said the attack involved a custom governance wrapper and the attack vector does not apply to standard Yearn vault setups. 

Term said it was coordinating with external security teams on asset recovery and remediation. It said it would “explore paths to address” any remaining shortfall.

The incident follows an April 2025 oracle error that triggered about 918 ETH in unintended liquidations. At the time, Term recovered about 556 ETH, reduced its final loss to 362 ETH and reimbursed affected users, according to its postmortem. Following the incident, Term pledged third-party validation for critical updates and greater governance transparency.