Decentralized lending protocol Term Finance has suffered a major security breach, losing an estimated $8.5 million in digital assets after an attacker successfully exploited governance control over its strategy vaults. Prominent blockchain security firms have confirmed the incident, which wiped out a significant portion of the platform’s total value locked in its vault products and prompted an immediate emergency shutdown by the protocol’s development team.
According to blockchain security analytics firm PeckShield, the unidentified attacker managed to drain approximately 2,843 Ether, which was valued at roughly $6.87 million at the time of the exploit. In addition to the Ethereum drain, the perpetrator made off with 1.68 million USDC, which was subsequently swapped for approximately 1.68 million Dai. Another leading blockchain security and analysis firm, CertiK, released a similar assessment of the incident, placing the cumulative financial damage right around the $8.5 million mark.
The scale of the losses dealt a heavy blow to Term Finance’s liquidity infrastructure. Data from decentralized finance tracking platform DefiLlama indicates that the reported losses wiped out approximately 68 percent of the total $12.45 million held within Term’s vault products prior to the attack. Furthermore, the breach consumed nearly all of the protocol’s Ethereum deposits, which stood at approximately $8.8 million just before the security compromise took place.
In response to the emergency, Term Labs—the development entity behind the protocol—took swift action. The team announced via social media that it had irreversibly shut down all Term Meta Vaults and successfully revoked their DAO governance roles. This emergency measure was designed to halt any further incoming deposits while intentionally keeping user withdrawals open to allow affected participants to retrieve whatever remaining funds were uncompromised. In its preliminary findings, Term Labs noted that its underlying core protocol, along with its direct borrowing and lending markets, appeared to remain unaffected by the exploit, though engineers were still actively verifying the full scope of the incident. Attempts by media outlets to reach Term Labs for direct comments on the matter were unsuccessful at the time of publication.
Attacker allegedly took control through governance
The mechanics behind the breach point toward a sophisticated governance manipulation strategy. Onchain monitoring and alert service Defimon reported that the attacker likely acquired a cheap majority stake in a sparsely held governance token associated with the protocol. By accumulating enough voting power with minimal financial outlay, the perpetrator was able to pass malicious governance proposals that ultimately granted them administrative control over Term’s strategy vaults. However, Term Finance has not yet officially confirmed the exact mechanism by which the attacker managed to secure voting control, nor has it detailed which specific governance functions were manipulated to execute the drain.
The compromised vault contracts were built using infrastructure derived from the Yearn V3 framework. Following initial speculation regarding the underlying architecture, Yearn issued a public statement clarifying that the exploit involved a custom governance wrapper implemented by Term Finance. Yearn emphasized that the specific attack vector utilized in this incident does not apply to standard, out-of-the-box Yearn vault setups.
As the situation unfolds, Term Finance has stated that it is actively coordinating with external cybersecurity and intelligence teams to strategize on asset recovery and remediation efforts. The protocol added that it would explore various viable paths to address any remaining financial shortfalls left by the exploit.
This security breach is not the first major hurdle Term Finance has faced in its operational history. The incident follows an earlier protocol event in April 2025, when an oracle error triggered approximately 918 ETH in unintended user liquidations. During that previous incident, Term successfully recovered about 556 ETH, managed to reduce its final net loss to 362 ETH, and fully reimbursed all affected users, according to its published postmortem report. In the wake of that oracle malfunction, Term had pledged to implement third-party validation for all critical protocol updates and committed to increasing overall governance transparency to prevent future vulnerabilities.
