Decentralized finance (DeFi) lending protocol Term Finance suffered a major security breach over the weekend, resulting in the loss of an estimated $8.5 million in digital assets. According to leading blockchain security firms, the attack was executed after a malicious actor successfully exploited the governance control mechanisms governing the protocol’s specialized strategy vaults.
The security incident unfolded rapidly, drawing immediate attention from onchain analysts and security researchers across the broader cryptocurrency ecosystem. Prominent blockchain security and threat intelligence firm PeckShield was among the first to alert the public on Sunday, reporting that an attacker had drained approximately 2,843 Ether (ETH). At the time of the exploit, the stolen Ether was valued at roughly $6.87 million. In addition to the native ETH, the attacker also absconded with 1.68 million USDC, which was subsequently swapped for approximately 1.68 million Dai (DAI).
Shortly after PeckShield’s initial alert, fellow security firm CertiK released a comparable assessment of the financial damage. CertiK’s independent analysis placed the total losses incurred by the protocol at approximately $8.5 million, aligning closely with the figures calculated by other onchain monitoring services.
The magnitude of the exploit severely impacted the protocol’s financial standing. According to comprehensive data provided by DeFi analytics platform DefiLlama, the reported losses represented roughly 68% of the total $12.45 million held within Term’s vault products prior to the attack. More critically, the breach wiped out nearly all of the approximately $8.8 million in Ethereum deposits that users had entrusted to these specific yield-generating vaults.
In response to the unfolding crisis, Term Labs—the development entity behind the protocol—took swift defensive measures. The team announced via social media that it had irreversibly shut down all Term Meta Vaults. Furthermore, developers revoked the associated DAO governance roles to prevent any additional unauthorized deposits or malicious alterations. However, the protocol kept user withdrawal functions open where possible to allow participants to retrieve whatever unaffected funds remained.
Initial internal investigations conducted by the Term Labs team indicated that the core underlying Term protocol, along with its direct borrowing and lending markets, remained entirely unaffected by the exploit. Despite this positive preliminary finding, developers stressed that they were still actively verifying the full scope of the security breach and examining all interacting smart contracts.
At the time of reporting, technology publication Cointelegraph had attempted to reach out to representatives from Term Labs for official comment on the incident, but received no immediate response.
Attacker Allegedly Took Control Through Governance
As security analysts continued to dissect the mechanics of the exploit, onchain monitoring service Defimon shed light on how the attacker managed to bypass the protocol’s security barriers. According to Defimon’s findings, the malicious actor managed to cheaply acquire a majority stake in a sparsely held governance token associated with the platform’s advanced features. By accumulating sufficient voting weight at a minimal cost, the attacker was able to successfully push through unauthorized proposals that ultimately handed them administrative control over Term’s strategy vaults.
Despite these detailed onchain observations, Term Finance has not yet officially confirmed the exact method by which the attacker obtained voting control, nor has it specified which exact governance functions were weaponized during the attack.
The architecture of the compromised vaults added another layer of technical complexity to the investigation. The vault contracts in question were built utilizing Yearn V3 infrastructure. This detail prompted immediate scrutiny regarding the safety of the underlying framework. However, the Yearn team quickly issued a public clarification stating that the exploit specifically involved a custom governance wrapper implemented by Term Finance. Yearn explicitly assured the community that the attack vector exploited in this incident does not apply to standard, out-of-the-box Yearn vault setups.
Amid the fallout, Term Finance management confirmed that they are actively coordinating with external cybersecurity and blockchain forensics teams to facilitate asset recovery operations and comprehensive protocol remediation. The project team also stated that they would explore various strategic paths to address any remaining financial shortfalls left by the incident, aiming to protect affected users to the greatest extent possible.
This recent security failure is not the first major hurdle Term Finance has faced in its operational history. The protocol previously experienced a notable security scare in April 2025, when an unexpected oracle error triggered approximately 918 ETH worth of unintended liquidations across its markets. During that previous incident, Term managed to successfully recover about 556 ETH through swift intervention, ultimately reducing its net final loss to 362 ETH and fully reimbursing all impacted users, according to the official postmortem report published by the project.
In the wake of that earlier oracle mishap, Term leadership had publicly pledged to implement stricter operational safeguards. These promises included mandatory third-party validation for all critical system updates and a commitment to greater transparency within its governance structures. However, this weekend’s governance-based exploit demonstrates the ongoing vulnerabilities that decentralized autonomous organizations and lending protocols continue to face as malicious actors find novel ways to manipulate voting mechanisms and administrative privileges.
