Term Finance Loses $8.5M in Ethereum Governance Exploit

Ethereum lending protocol Term Finance lost roughly $8.5 million on August 23, 2026 after an attacker seized control of the protocol’s governance and used it to drain the platform’s Strategy Vaults.

Term Labs confirmed the incident directly on X:

According to on-chain investigators, the attacker funded the entire operation with just 2 ETH pulled from Tornado Cash, then spent that seed capital quietly accumulating Term’s sparsely held DAO governance token until they controlled a majority of the vote. From there, they authored and passed proposals that handed the Strategy Vaults’ funds directly to their own wallet — no smart contract bug involved, just a governance vote the protocol was obligated to honor.

The haul totaled 2,843 ETH, worth about $6.87 million, plus 1.68 million USDC, which the attacker promptly swapped into DAI. Analysts pointed out that the exploit routed around protections that should have stopped it, Term’s 7-day timelock and an LP veto mechanism, by going through custom governance logic layered on top of the vault system rather than the standard checks.

The scare briefly spilled onto Yearn Finance, since Term’s Strategy Vaults were built on Yearn’s V3 vault framework. Yearn moved quickly to clarify that the exploit hit Term’s own custom governance wrapper, not Yearn’s standard contracts, and that other Yearn-based vaults were unaffected.

Term Labs’ response was to shut the product down rather than patch around the hole: it permanently closed all Meta Vault deposits and revoked the DAO governance roles that made the attack possible, while keeping withdrawals open for remaining users. The protocol’s TVL fell from about $25.8 million before the exploit to roughly $6.84 million after, as depositors pulled out.

Term Finance is the latest reminder that a governance system is itself an attack surface — if voting power is cheap enough to buy, “the DAO approved it” stops being a safeguard and becomes the exploit. August 2026 alone has now seen roughly $27 million drained across DeFi governance-style attacks.

Want to understand how DAO governance attacks actually work under the hood? Explore more in our Bitcoin Academy.