Decentralized lending protocol Term Finance has suffered a major security breach, losing an estimated $8.5 million following an exploit targeting the governance control of its strategy vaults. Prominent blockchain security firms have confirmed the incident, which wiped out a significant portion of the protocol’s total value locked in its vault products and prompted an immediate emergency response from the project’s developers.
On Sunday, blockchain security and analytics firm PeckShield reported via social media that the attacker successfully drained approximately 2,843 Ether (ETH), which was valued at roughly $6.87 million at the time of the exploit. In addition to the Ethereum, the attacker made off with 1.68 million USDC, which was subsequently swapped for approximately 1.68 million Dai (DAI). Another leading blockchain security organization, CertiK, released a similar estimate shortly after, putting the aggregate financial damage at around $8.5 million.
The scale of the breach represents a devastating blow to the platform’s liquidity and asset base. According to historical and real-time data tracked by DefiLlama, the reported losses account for roughly 68 percent of the total $12.45 million that had been held within Term’s vault product line prior to the attack. Most alarmingly, the breach drained nearly all of the protocol’s approximately $8.8 million in Ethereum deposits, leaving users and developers scrambling to assess the wreckage.
In response to the exploit, Term Labs moved quickly to mitigate further damage. The development team announced that it had irreversibly shut down all Term Meta Vaults and successfully revoked their decentralized autonomous organization (DAO) governance roles. This emergency action effectively blocked any further deposits from being made into the vulnerable vaults while deliberately keeping withdrawal pathways open for users where possible.
In its preliminary assessments, Term Labs stated that its underlying core protocol—including its direct borrowing and lending markets—remained unaffected by the exploit. However, the team noted that it was still actively verifying the full scope of the security incident and investigating the exact mechanics used by the attacker. Cointelegraph attempted to reach Term Labs for additional comment regarding the ongoing situation, but was unable to secure a direct response at the time of publication.
Attacker Allegedly Took Control Through Governance
According to insights shared by onchain monitoring service Defimon, the exploit did not rely on a traditional smart contract code vulnerability or flash loan attack vector. Instead, the attacker reportedly acquired a cheap majority stake in a sparsely held governance token associated with the protocol. Armed with this voting power, the malicious actor allegedly passed unauthorized proposals that granted them direct administrative control over Term’s strategy vaults.
As of yet, Term Finance has not officially confirmed the exact mechanics of how the attacker managed to accumulate sufficient voting control, nor has it detailed which specific governance functions were manipulated to execute the drain.
The vault contracts in question were built using Yearn V3 infrastructure, prompting initial questions within the decentralized finance community regarding the safety of the underlying framework. However, Yearn quickly clarified the situation, stating that the attack involved a custom governance wrapper implemented by Term Finance. Yearn emphasized that the specific attack vector utilized in this incident does not apply to standard, out-of-the-box Yearn vault setups.
Amid the fallout, Term Finance has confirmed that it is actively coordinating with external cybersecurity and intelligence teams to pursue asset recovery strategies and comprehensive remediation efforts. The protocol has also indicated that it will explore various paths to address any remaining shortfalls left by the hack, though specific reimbursement plans have not yet been finalized.
This security breach is not the first major hurdle the protocol has faced. In April 2025, Term Finance experienced a separate oracle error that triggered approximately 918 ETH in unintended liquidations across its platform. During that previous incident, the project successfully recovered roughly 556 ETH, ultimately reducing its final net loss to 362 ETH and fully reimbursing the affected users, according to its published postmortem report. In the wake of that oracle failure, Term had explicitly pledged to implement mandatory third-party validation for all critical protocol updates and promised greater transparency in its governance operations.
