Decentralized lending protocol Term Finance has suffered a major security breach resulting in an estimated $8.5 million loss after an attacker successfully exploited governance control over its strategy vaults. Prominent blockchain security and onchain analytics firms quickly flagged the unauthorized transactions over the weekend, revealing that a significant portion of the platform’s total value locked had been drained within a remarkably short window.
According to reports published by blockchain security firm PeckShield on Sunday, the attacker managed to drain approximately 2,843 Ether (ETH)—which was valued at roughly $6.87 million at the time of the exploit—alongside 1.68 million USDC. The stolen stablecoins were subsequently swapped for approximately 1.68 million Dai (DAI) on-chain. Another prominent security and auditing firm, CertiK, made a closely aligned estimate, putting the total aggregate losses incurred by the protocol at around $8.5 million.
The scale of the breach represents a severe blow to the platform’s liquidity and vault ecosystem. DefiLlama data indicates that the reported losses accounted for roughly 68 percent of the total $12.45 million held within Term’s specialized vault product prior to the attack. Furthermore, the exploit consumed nearly all of the protocol’s approximately $8.8 million in Ethereum deposits, leaving users and developers scrambling to assess the damage and secure remaining assets.
In response to the incident, Term Labs announced through official channels that it had taken swift, irreversible action to shut down all Term Meta Vaults. The development team revoked their associated decentralized autonomous organization (DAO) governance roles to prevent any further unauthorized deposits or manipulations, while deliberately keeping withdrawal functions open to allow users to pull out whatever assets remained safely accounted for. Preliminary internal investigations conducted by the team suggested that the underlying Term protocol and its direct borrowing and lending markets remained unaffected by the exploit, though developers emphasized that they were still actively verifying the full scope of the security breach. Cointelegraph attempted to reach out to Term Labs for further comment regarding the ongoing situation, but was unable to secure an immediate response.
Attacker Allegedly Took Control Through Governance Mechanisms
As security analysts and community sleuths dove into the onchain data to reconstruct the sequence of events, onchain monitoring service Defimon shared critical insights regarding how the exploit was executed. According to Defimon, the attacker cheaply acquired a controlling majority of a sparsely held governance token associated with the protocol. By accumulating sufficient voting weight at a minimal cost, the malicious actor was able to push through unauthorized governance proposals that ultimately granted them absolute control over Term’s strategy vaults. To date, Term has not officially confirmed the precise method by which the attacker obtained voting control or which specific governance functions were manipulated to execute the takeover.
Adding further technical clarification to the incident, details emerged regarding the underlying infrastructure of the vaults. The vault contracts in question were built using Yearn V3 infrastructure. However, Yearn stepped forward to clarify that the exploit did not stem from any inherent vulnerability in its core codebase. Yearn explained via social media that the attack heavily involved a custom governance wrapper implemented by the Term team, meaning the specific attack vector utilized in this exploit does not apply to standard Yearn vault setups.
This security breach is not the first major hurdle Term Finance has faced in its operational history. The platform previously experienced an incident in April 2025, when an oracle error triggered approximately 918 ETH in unintended liquidations across its markets. During that previous event, Term successfully intervened and recovered about 556 ETH, ultimately reducing its final net loss to 362 ETH and fully reimbursing the affected users, according to its published postmortem report. In the wake of that oracle malfunction, Term had publicly pledged to implement third-party validation for critical system updates and committed to ensuring greater governance transparency moving forward.
As the situation continues to unfold, Term has stated that it is actively coordinating with external blockchain security and forensic teams to pursue asset recovery and comprehensive remediation. The protocol has indicated that it will explore various paths to adequately address any remaining financial shortfalls resulting from the governance exploit, while blockchain investigators continue to track the movement of the stolen funds across the decentralized finance landscape.
