Decentralized finance (DeFi) protocol Term Finance has fallen victim to a major security breach, suffering an estimated $8.5 million loss after an attacker successfully exploited governance control over its strategy vaults. According to assessments shared by leading blockchain security firms, the incident severely depleted the platform’s liquidity pools, though core lending markets appear to have escaped direct compromise.
The exploit unfolded over the weekend, drawing immediate attention from onchain analytics and security monitors. On Sunday, blockchain security firm PeckShield reported that an attacker had drained approximately 2,843 Ether (ETH)—valued at roughly $6.87 million at the time of the breach—alongside 1.68 million USDC. The stolen stablecoins were subsequently swapped for approximately 1.68 million Dai (DAI). Another prominent security firm, CertiK, released a concurrent evaluation, estimating the total financial damage at around $8.5 million.
The scale of the breach represents a devastating blow to the protocol’s vault product. DefiLlama data indicates that the reported losses wiped out approximately 68% of the $12.45 million total value locked (TVL) held within Term’s vault products prior to the attack. Furthermore, the incident drained nearly all of the approximately $8.8 million in Ethereum deposits that users had entrusted to the platform.
In response to the emergency, Term Labs took swift containment measures. The development team announced via social media that it had irreversibly shut down all Term Meta Vaults and successfully revoked their decentralized autonomous organization (DAO) governance roles. These emergency actions effectively halted any further deposits into the affected vaults while ensuring that user withdrawals remained open. In its preliminary findings, Term Labs stated that the underlying Term protocol and its direct peer-to-peer borrowing and lending markets were left unaffected by the exploit, although the team emphasized that it was still actively verifying the full scope of the incident. Attempts by media outlets to reach Term Labs for direct comment regarding the ongoing situation were unsuccessful.
Attacker Allegedly Took Control Through Governance
As security analysts and investigators combed through transaction data to piece together how the breach occurred, onchain monitoring service Defimon shed light on the attack vector. According to Defimon, the attacker managed to cheaply acquire a majority stake in a sparsely held governance token associated with the protocol. With voting power concentrated in their hands, the perpetrator successfully pushed through malicious governance proposals that granted them administrative control over Term’s strategy vaults. To date, Term Finance has not officially confirmed the exact mechanism by which the attacker managed to secure voting control, nor has it detailed which specific governance functions were manipulated to execute the drain.
The technical architecture of the vaults added another layer of scrutiny to the incident. Term’s vault contracts were built using infrastructure derived from Yearn V3. However, Yearn quickly moved to clarify its standing, stating publicly that the exploit involved a custom governance wrapper implemented by Term Finance. Yearn emphasized that the specific attack vector utilized in this breach does not apply to standard, out-of-the-box Yearn vault setups.
As the situation developed, Term Finance affirmed that it was actively coordinating with external cybersecurity and intelligence teams to strategize asset recovery operations and long-term remediation. The protocol stated that it would explore various pathways to address any remaining shortfall left by the exploit.
This security failure marks another difficult chapter for Term Finance, which previously encountered operational turbulence in April 2025. At that time, an oracle error triggered approximately 918 ETH in unintended liquidations across the platform. Following that incident, Term managed to recover roughly 556 ETH, successfully reducing its final net loss to 362 ETH and reimbursing the affected users, as documented in its public postmortem. In the wake of that oracle malfunction, the project had publicly pledged to implement third-party validation for critical system updates and to foster greater transparency in its governance processes.
