Decentralized lending protocol Term Finance has suffered a major security breach resulting in an estimated $8.5 million loss after an attacker successfully exploited governance control mechanisms governing its strategy vaults. According to reports from prominent blockchain security firms, the malicious actor managed to orchestrate a sophisticated takeover by seizing control of critical administrative privileges, draining a significant portion of the protocol’s liquidity before developers could intervene.
The security incident first came to light over the weekend when blockchain security and analytics platform PeckShield reported that an unauthorized actor had drained approximately 2,843 Ether (ETH). At the time of the exploit, the stolen Ethereum was valued at roughly $6.87 million. In addition to the drained ETH, the attacker also seized 1.68 million USDC. This stablecoin sum was subsequently swapped for approximately 1.68 million Dai (DAI). Shortly after PeckShield’s initial alert, fellow blockchain security firm CertiK released a parallel assessment, placing the total estimated losses from the exploit at approximately $8.5 million.
The financial impact of the breach represents a devastating blow to the protocol’s vault product ecosystem. According to data compiled by DefiLlama, the reported losses account for roughly 68 percent of the total $12.45 million held within Term’s vault products immediately prior to the attack. More critically, the exploit drained nearly all of the protocol’s Ethereum deposits, which stood at approximately $8.8 million prior to the breach.
In response to the emergency, Term Labs—the development entity behind the protocol—moved quickly to contain the damage. The team announced via social media that it had irreversibly shut down all Term Meta Vaults and successfully revoked their decentralized autonomous organization (DAO) governance roles. This emergency action was designed to halt any further deposits into the affected vaults while intentionally keeping withdrawal pathways open for users where possible.
In its preliminary assessment, Term Labs stated that its ongoing investigation found the underlying Term protocol and its direct borrowing and lending markets to remain entirely unaffected by the exploit. However, the team emphasized that it was still actively verifying the full scope of the breach and analyzing how the exploit was executed. Attempts by industry media outlets, including Cointelegraph, to reach Term Labs for additional comment regarding the incident were unsuccessful at the time of publication.
Attacker allegedly took control through governance
While official confirmation regarding the exact mechanics of the exploit remains pending, initial onchain intelligence provides a clearer picture of how the breach unfolded. According to findings from onchain monitoring service Defimon, the attacker managed to cheaply acquire a majority stake of a sparsely held governance token associated with the protocol. Armed with this voting power, the malicious actor successfully pushed through malicious proposals that effectively granted them absolute control over Term’s strategy vaults.
To date, Term Finance has not officially confirmed the precise method by which the attacker obtained voting control or which specific governance functions were manipulated to execute the takeover.
Further complicating the technical analysis, the compromised vault contracts were built using Yearn V3 infrastructure. This detail prompted immediate scrutiny regarding the security of the underlying framework. However, representatives from Yearn quickly clarified the situation, stating that the attack involved a custom governance wrapper implemented by Term Finance. Yearn explicitly noted that the specific attack vector utilized in the breach does not apply to standard, out-of-the-box Yearn vault setups.
Amid the fallout, Term Finance management has stated that it is actively coordinating with external cybersecurity teams and specialized incident response firms to facilitate asset recovery and formulate a comprehensive remediation plan. The protocol has also indicated that it will explore various paths to address any remaining financial shortfall left by the exploit.
The latest governance breach compounds an already challenging historical precedent for the protocol. The incident follows an earlier security scare in April 2025, when a severe oracle pricing error triggered approximately 918 ETH in unintended user liquidations. During that previous incident, Term successfully recovered roughly 556 ETH, ultimately reducing its final net loss to 362 ETH and fully reimbursing the affected users, according to its published postmortem report.
In the wake of that oracle failure, Term Finance had publicly pledged to implement rigorous third-party validation protocols for all critical system updates and promised greater transparency across its governance operations. As the protocol now faces this new, significantly larger crisis, the incident underscores the persistent and evolving vulnerabilities associated with governance token concentration and decentralized administrative control structures within the broader decentralized finance ecosystem.
