Decentralized finance (DeFi) protocol Term Finance has suffered a major security breach, losing an estimated $8.5 million following an exploit targeting the governance control of its strategy vaults. Prominent blockchain security firms have confirmed the incident, which wiped out a substantial portion of the protocol’s total value locked (TVL) and forced emergency shutdowns across its infrastructure.
According to reports published on Sunday by blockchain security and analytics platform PeckShield, the unidentified attacker successfully drained approximately 2,843 Ether (ETH), which was valued at roughly $6.87 million at the time of the exploit. In addition to the Ethereum, the perpetrator made off with 1.68 million USDC, a stablecoin that was subsequently swapped for approximately 1.68 million Dai (DAI). Another leading blockchain security firm, CertiK, released a concurrent assessment that corroborated PeckShield’s findings, placing the total estimated losses at approximately $8.5 million.
The sudden and devastating financial blow accounted for roughly 68 percent of the total $12.45 million held within Term’s vault products immediately preceding the attack. Data provided by decentralized finance analytics platform DefiLlama highlights the severity of the drain, noting that the exploit wiped out nearly all of the protocol’s approximately $8.8 million in Ethereum deposits.
In response to the emergency, Term Labs took swift defensive action. The development team announced that it had irreversibly shut down all Term Meta Vaults and successfully revoked their DAO governance roles. This emergency measure was designed to halt any further deposits into the compromised vaults while deliberately keeping user withdrawals open to prevent complete fund lockups. In its initial preliminary assessments, Term Labs reported that the underlying Term protocol, along with its direct borrowing and lending markets, appeared to remain unaffected by the exploit, though the team emphasized that it was still actively verifying the full scope of the incident. Attempts by media outlets, including Cointelegraph, to reach Term Labs for direct comments regarding the incident were unsuccessful at the time of publication.
Attacker Allegedly Took Control Through Governance
Initial technical analyses from onchain monitoring services suggest that the breach was orchestrated through a calculated takeover of the protocol’s governance mechanism rather than a traditional code vulnerability in the smart contracts. According to onchain monitoring service Defimon, the attacker managed to cheaply acquire a majority stake in a sparsely held governance token. Armed with this sudden voting majority, the perpetrator was able to pass malicious proposals that ultimately granted them administrative control over Term’s strategy vaults.
While the general mechanism of the attack points toward a governance manipulation strategy, Term Finance has not yet officially confirmed the exact method by which the attacker obtained voting control, nor has it detailed which specific governance functions were exploited to execute the drainage of funds.
The structural architecture of the affected vault contracts relies on Yearn V3 infrastructure. However, the Yearn team quickly moved to clarify its own security posture following the incident. In a public statement, Yearn explained that the exploit specifically involved a custom governance wrapper implemented by Term Finance. Consequently, Yearn assured its community that the attack vector exploited in this incident does not apply to standard, out-of-the-box Yearn vault setups.
As the fallout from the exploit continues to unfold, Term Finance stated that it is actively coordinating with external blockchain security and forensics teams to pursue asset recovery and comprehensive remediation strategies. Furthermore, the protocol indicated that it would explore various viable paths to address and cover any remaining financial shortfall left by the exploit.
This recent security breach follows a previous operational hiccup experienced by the protocol in April 2025. During that earlier incident, an oracle error triggered approximately 918 ETH in unintended liquidations across the platform. According to Term’s official postmortem report from that period, the protocol managed to successfully recover about 556 ETH, ultimately reducing its final net loss to 362 ETH and fully reimbursing the affected users. In the wake of that oracle failure, Term Finance had publicly pledged to implement third-party validation for critical protocol updates and committed to enhancing overall governance transparency to prevent future disruptions.
