Decentralized lending protocol Term Finance has suffered an estimated $8.5 million loss following a sophisticated security incident in which an attacker successfully exploited governance controls governing its strategy vaults, according to leading blockchain security firms.
The exploit, which unfolded over the weekend, severely impacted the platform’s liquidity pools and prompted immediate emergency shutdowns from the development team. Prominent Web3 security and analytics firms quickly mobilized to assess the damage, tracing the movement of funds across multiple blockchain networks and highlighting vulnerabilities in the protocol’s administrative architecture.
According to data and alerts published on Sunday by blockchain security firm PeckShield, the perpetrator managed to drain approximately 2,843 Ether, which was valued at roughly $6.87 million at the time of the breach. In addition to the stolen Ethereum, the attacker made off with 1.68 million USDC, a stablecoin that was subsequently swapped for approximately 1.68 million Dai. Fellow security auditor CertiK released a parallel assessment of the incident, placing the aggregate losses at a comparable figure of around $8.5 million.
The scale of the financial impact relative to the protocol’s total value locked was substantial. DefiLlama data indicates that the reported losses wiped out approximately 68% of the $12.45 million that had been held within Term Finance’s vault product prior to the attack. This included nearly the entirety of the platform’s approximately $8.8 million in Ethereum deposits, leaving users and developers scrambling to respond to the sudden liquidity crisis.
In response to the breach, Term Labs issued a series of public statements via social media confirming that it had taken the drastic measure of irreversibly shutting down all Term Meta Vaults. Furthermore, the development team revoked the associated decentralized autonomous organization governance roles tied to those vaults. These emergency actions were designed to block any further deposits into the compromised system while intentionally keeping withdrawal pathways open for users attempting to salvage remaining assets.
Preliminary internal investigations conducted by Term Labs suggested that the underlying Term protocol and its direct borrowing and lending markets remained unaffected by the exploit. However, the team emphasized that verification efforts were ongoing to fully determine the complete scope of the security breach. At the time of reporting, industry publication Cointelegraph had been unable to reach Term Labs for direct comment outside of their official public statements.
Attacker Allegedly Took Control Through Governance
As security researchers dug deeper into the mechanics of the exploit, onchain monitoring service Defimon shed light on how the breach was executed. According to Defimon alerts, the attacker capitalized on a sparsely held governance token supply, cheaply acquiring a majority stake. Armed with this voting power, the perpetrator was able to pass malicious proposals that ultimately granted them full operational control over Term Finance’s vaults.
Despite these insights from onchain analytics providers, Term Finance has not yet formally confirmed the exact mechanism by which the attacker managed to secure voting control, nor have they detailed which specific governance functions were manipulated during the attack.
A point of clarification also emerged regarding the underlying infrastructure of the vaults. The affected contracts were built using Yearn V3 infrastructure, prompting immediate questions about the security of the broader Yearn ecosystem. However, representatives for Yearn clarified that the exploit did not stem from vulnerabilities in standard Yearn vault configurations. Instead, Yearn confirmed that the attack specifically involved a custom governance wrapper implemented by Term Finance, meaning the underlying attack vector was unique to Term’s proprietary setup rather than an inherent flaw in Yearn’s core code.
In the wake of the incident, Term Finance stated that it was actively coordinating with external cybersecurity and blockchain forensics teams to facilitate asset recovery and formulate comprehensive remediation strategies. The protocol also pledged to explore viable pathways to address and cover any remaining financial shortfalls affecting its user base.
The latest exploit compounds an already challenging operational history for the decentralized finance protocol. The incident closely follows a notable security event from April 2025, when an oracle error triggered approximately 918 ETH in unintended liquidations across the platform. During that previous event, Term successfully recovered about 556 ETH, ultimately reducing its final net loss to 362 ETH and reimbursing affected users, as detailed in its official postmortem report.
In the aftermath of the 2025 oracle incident, Term had publicly pledged to implement rigorous third-party validation for critical protocol updates and to foster greater transparency within its governance structures. As the protocol navigates this latest crisis, stakeholders and community members are closely watching to see how the team manages the recovery process and restores confidence in its administrative systems.
