Decentralized lending protocol Term Finance has suffered a major security breach resulting in an estimated $8.5 million loss after an attacker successfully exploited the governance control mechanisms governing its specialized strategy vaults. The incident, which unfolded over the weekend, has dealt a severe blow to the platform’s liquidity and forced developers to take drastic emergency measures to secure remaining user funds. According to prominent blockchain security and analytics firms tracking the exploit, the attack targeted the core structural governance framework of the vaults, allowing an unauthorized actor to seize operational control and drain significant digital assets from the protocol.
Blockchain security firm PeckShied was among the first to alert the decentralized finance community to the breach, noting on Sunday that the attacker had managed to drain approximately 2,843 Ether (ETH). At the time of the transaction, the stolen Ethereum was valued at roughly $6.87 million. In addition to the native ETH, the perpetrator siphoned about 1.68 million USDC, which was subsequently swapped for approximately 1.68 million Dai (DAI). Another leading blockchain security and intelligence firm, CertiK, published a comparable assessment of the incident, placing the aggregate financial damage at approximately $8.5 million when factoring in all affected token pools and subsequent asset swaps.
The scale of the breach represents a devastating hit to Term Finance’s product ecosystem. DefiLlama data indicates that the reported losses wiped out approximately 68% of the total value locked inside Term’s vault product prior to the attack, which stood at roughly $12.45 million. More critically, the breach successfully drained nearly all of the approximately $8.8 million in Ethereum deposits held within those specific vaults. The swift and comprehensive nature of the drainage highlights ongoing vulnerabilities in how decentralized finance protocols manage governance privileges, particularly within complex, interconnected yield-generation strategies.
In response to the emergency, Term Labs, the development entity behind the protocol, took swift action to contain the damage. The team announced via social media that it had irreversibly shut down all Term Meta Vaults and successfully revoked their decentralized autonomous organization (DAO) governance roles. This defensive maneuver was designed to prevent any further deposits into the compromised system while intentionally keeping withdrawal pathways open so that users could attempt to retrieve whatever unaffected funds remained. Furthermore, preliminary investigations conducted by the Term Labs team indicated that the underlying Term protocol, along with its direct peer-to-peer borrowing and lending markets, remained entirely unaffected by the exploit, though developers emphasized that they were still actively verifying the full scope of the security breach.
Attempts by industry reporters to reach representatives at Term Labs for additional comment regarding the incident were unsuccessful at the time of publication.
Attacker allegedly took control through governance
As blockchain security analysts and forensic investigators continue to dissect the mechanics of the exploit, initial reports from onchain monitoring services point toward a sophisticated governance takeover. According to onchain monitoring service Defimon, the attacker allegedly executed a low-cost accumulation strategy, quietly acquiring a majority stake of a sparsely held governance token associated with the protocol. Armed with this sudden voting majority, the perpetrator was able to push through malicious proposals that granted them direct control over Term’s administrative vaults, bypassing standard security checks and enabling the large-scale extraction of funds.
To date, Term Finance has not officially confirmed the exact mechanics of how the attacker managed to secure voting control, nor have they detailed which specific governance functions were manipulated to execute the drain. However, the architectural design of the vaults has drawn significant scrutiny from the broader decentralized finance community. The vault contracts in question were built using Yearn V3 infrastructure. Because of this architectural choice, representatives from the Yearn ecosystem quickly moved to clarify their position, releasing a statement explaining that the exploit specifically involved a custom governance wrapper implemented by Term Finance. Yearn explicitly noted that the underlying attack vector does not apply to standard, out-of-the-box Yearn vault setups.
Amid the unfolding situation, Term Finance leadership stated that they are actively coordinating with external cybersecurity firms and white-hat intelligence teams to pursue asset recovery strategies and comprehensive system remediation. The protocol acknowledged that it would actively explore various pathways to address any remaining financial shortfall experienced by its user base, though specific details regarding compensation plans or treasury bailouts have not yet been finalized.
This latest security incident is not the first time Term Finance has faced operational hurdles. The protocol previously weathered a notable crisis in April 2025, when an oracle error triggered approximately 918 ETH in unintended and erroneous liquidations across its markets. During that previous event, the protocol managed to successfully recover about 556 ETH, ultimately reducing its final net loss to 362 ETH and fully reimbursing the affected users, as documented in its official postmortem report. In the wake of that oracle malfunction, Term had publicly pledged to implement rigorous third-party validation for all critical system updates and to foster greater transparency in its governance operations.
