Decentralized lending protocol Term Finance has suffered a major security breach resulting in an estimated $8.5 million loss after an attacker successfully exploited governance control over its strategy vaults. Prominent blockchain security and onchain analytics firms first flagged the suspicious activity over the weekend, revealing that the perpetrator managed to seize control of the protocol’s yield-generating architecture to drain substantial digital asset reserves.
On Sunday, prominent blockchain security firm PeckShield reported via social media that the attacker had managed to drain approximately 2,843 Ether, which was valued at roughly $6.87 million at the time of the exploit. In addition to the Ethereum drainage, the attacker made off with 1.68 million USDC, which was subsequently swapped for approximately 1.68 million Dai. Another leading blockchain intelligence and security organization, CertiK, released a concurrent assessment placing the total financial damage at approximately $8.5 million, aligning closely with calculations from other independent onchain auditors.
The severe capital outflow represented a catastrophic blow to the platform’s liquidity pools. Prior to the attack, Term’s vault products held roughly $12.45 million in total assets. According to comprehensive historical data provided by DefiLlama, the breach wiped out roughly 68% of that total value, successfully draining nearly all of the protocol’s approximately $8.8 million in native Ethereum deposits.
In response to the emergency, Term Labs announced that it had taken swift, albeit drastic, operational measures. The development team stated that it had irreversibly shut down all Term Meta Vaults and successfully revoked their decentralized autonomous organization governance roles. This emergency intervention effectively halted any further deposits into the compromised structures while purposely keeping user withdrawals open to facilitate potential recovery avenues. According to preliminary statements released by the protocol team, an internal investigation indicated that the underlying Term protocol and its direct peer-to-peer borrowing and lending markets remained completely unaffected by the exploit, though developers noted they were still actively verifying the full scope and boundaries of the breach. Cointelegraph attempted to reach out to Term Labs for additional comment regarding the incident, but representatives were unavailable at the time of publication.
Attacker Allegedly Took Control Through Governance Mechanisms
As security analysts and protocol developers raced to piece together how the breach occurred, onchain monitoring service Defimon shed light on the mechanics of the attack. According to Defimon’s breakdown, the perpetrator cheaply acquired a majority stake in a sparsely held governance token associated with the protocol’s management structure. By amassing these voting rights, the attacker was able to push through malicious proposals that granted them direct administrative control over Term’s strategy vaults. As of the latest updates, Term has not officially confirmed the exact method by which the attacker managed to secure voting control, nor has it detailed precisely which specific governance functions were manipulated to execute the drain.
The technical architecture of the affected vaults relies on Yearn V3 infrastructure, prompting immediate questions across the decentralized finance community regarding the safety of the underlying framework. However, Yearn representatives quickly clarified the situation, stating publicly that the exploit specifically involved a custom governance wrapper implemented by Term. Yearn emphasized that the unique attack vector utilized in the incident does not apply to standard, out-of-the-box Yearn vault setups, thereby distancing their core infrastructure from the vulnerability.
In the wake of the exploit, Term confirmed that it is actively coordinating with a coalition of external security teams, whitehat hackers, and onchain forensics specialists to focus on asset recovery and long-term protocol remediation. The project team also stated that it intends to explore various financial paths to address any remaining funding shortfalls left by the multi-million-dollar drainage.
This unfortunate security incident follows a previous operational hurdle experienced by the protocol in April 2025. During that earlier event, an oracle error triggered approximately 918 ETH in unintended liquidations across the platform. In the aftermath of that oracle failure, Term successfully recovered about 556 ETH, which significantly reduced its final net loss to 362 ETH, and subsequently reimbursed all affected users, according to its published postmortem report. Following that oracle-related incident, Term had publicly pledged to implement mandatory third-party validation procedures for all critical protocol updates and promised greater transparency in its overarching governance operations.
