Term Finance loses estimated $8.5M in vault governance exploit

Decentralized lending protocol Term Finance suffered a major loss after an attacker exploited governance control of its strategy vaults, draining an estimated $8.5 million.

Scale of the loss

Security firm PeckShield reported that the attacker withdrew about 2,843 ETH, valued at roughly $6.87 million, and 1.68 million USDC, which was swapped for an equivalent amount of DAI. CertiK’s estimate of the total loss aligns at around $8.5 million, representing roughly 68 % of the $12.45 million held in Term’s vault product before the breach.

Response from Term Finance

Term Labs announced the irreversible shutdown of all Meta Vaults, revoking DAO governance roles and halting new deposits while keeping withdrawals open. The company indicated that the core Term protocol and its direct borrowing and lending markets remain unaffected, though verification is ongoing.

How the attacker gained control

On‑chain monitoring service Defimon said the attacker acquired a majority of a sparsely held governance token at low cost and passed proposals that granted control over the vaults. The vault contracts use Yearn V3 infrastructure, but Yearn clarified that the exploit involved a custom governance wrapper and does not affect standard Yearn vault setups.

Previous incidents and remediation

Term Finance previously experienced an oracle error in April 2025 that caused unintended liquidations of about 918 ETH. The protocol recovered part of the loss and reimbursed affected users. Following that event, Term pledged third‑party validation for critical updates and greater governance transparency. After the recent exploit, Term is coordinating with external security teams to explore asset recovery and address any remaining shortfall.