On Sunday, blockchain security and threat intelligence firm PeckShield alerted the crypto community to the breach, reporting that an attacker successfully drained approximately 2,843 Ether (ETH), which was valued at roughly $6.87 million at the time of the incident. Additionally, the perpetrator made off with 1.68 million USDC, which was subsequently swapped for approximately 1.68 million Dai (DAI) to consolidate the stolen funds. Around the same time, rival security firm CertiK published a parallel assessment, placing the aggregate losses incurred by the protocol and its depositors at approximately $8.5 million.
The financial damage represents a staggering portion of the capital entrusted to the protocol. Data compiled by decentralized finance analytics platform DefiLlama indicates that the reported losses wiped out nearly 68% of the total $12.45 million held within Term’s vault product prior to the exploit. Furthermore, the attack devoured almost the entirety of the platform’s roughly $8.8 million in Ethereum deposits, leaving users scrambling to assess the security of their remaining funds and looking to the development team for answers.
In response to the unfolding crisis, Term Labs moved quickly to mitigate further damage. The project announced via social media that it had irreversibly shut down all Term Meta Vaults and revoked their associated decentralized autonomous organization (DAO) governance roles. This drastic measure successfully halted any additional incoming deposits while deliberately keeping withdrawal functionalities open, allowing remaining users to pull out whatever assets were spared by the exploit. In its preliminary post-incident updates, Term Labs noted that its ongoing investigation found the underlying Term protocol and its direct borrowing and lending markets remained unaffected, though engineering teams were continuing to verify the complete scope of the breach. Industry publication Cointelegraph attempted to reach out to Term Labs for further comment regarding the incident, but representatives were unavailable at the time of publication.
Attacker allegedly took control through governance
As security researchers and onchain forensic analysts delved into the mechanics of the exploit, details began to emerge regarding how the perpetrator managed to breach the protocol’s defenses. Onchain monitoring service Defimon reported that the attacker executed a targeted governance takeover. According to Defimon’s analysis, the malicious actor cheaply acquired a majority stake in a sparsely held governance token associated with the protocol. Once holding dominant voting power, the attacker allegedly pushed through malicious proposals that granted them administrative control over Term’s strategy vaults, effectively bypassing traditional security parameters.
Despite these circulating insights from independent onchain monitors, Term Finance has not yet officially confirmed the exact mechanism by which the attacker obtained voting control, nor has it detailed precisely which governance functions were leveraged to execute the theft.
Technical complications also drew attention to the infrastructure underpinning the vaults. The vault contracts in question were built using Yearn V3 infrastructure, raising initial questions about the security of the underlying framework. However, Yearn quickly moved to clarify its position, stating publicly that the attack specifically involved a custom governance wrapper implemented by Term Finance. Yearn emphasized that the exploit vector utilized in the attack does not apply to standard, out-of-the-box Yearn vault setups, insulating the core Yearn infrastructure from blame.
Term Finance has stated that it is actively coordinating with external cybersecurity firms and expert forensic teams to pursue asset recovery efforts and develop comprehensive remediation strategies. The protocol also indicated that it would explore various paths to address any remaining shortfalls experienced by affected depositors, though concrete reimbursement plans have not yet been finalized.
The weekend exploit is particularly damaging given Term’s prior history with security and risk management. The protocol previously suffered an incident in April 2025, when an unexpected oracle error triggered roughly 918 ETH in unintended liquidations across the platform. During that earlier event, Term managed to recover about 556 ETH, successfully reducing its final net loss to 362 ETH and fully reimbursing the users who had been impacted, as documented in the project’s official postmortem. In the wake of that oracle malfunction, Term leadership publicly pledged to implement third-party validation protocols for all critical system updates and promised greater transparency in its governance operations.
As the investigation continues, Term Finance faces mounting pressure from the DeFi community to provide a comprehensive post-incident report detailing the exact vector of the governance breach and outlining a clear path forward for compensating users who suffered losses.
