Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
Currencies38693
Market Cap$ 2.72T+0.26%
24h Spot Volume$ 36.51B-31.7%
DominanceBTC57.18%+0.46%ETH10.92%+1.56%
ETH Gas0.07 Gwei
News
Aug 23, 2026
2min read
byRizwan Ansari
forCoinpedia
<img src="https://xpertsstudio.com/wp-content/uploads/2026/08/Unleash-Protocol-Hack-Drains-3.9M-After-Multisig-Exploit-PeckShield-Reveals-1.jpg" alt="Defi Protocol Term Labs Loses $8.5M in Governance Exploit” loading=”lazy”>
DeFi protocol Term Labs suffered an $8.5M governance exploit after an attacker amassed voting power to control several vaults and approved transfers, draining ~2,843 ETH (~$6.87M) plus roughly $1.6M in DAI and $1.68M USDC swapped to DAI. The attacker, funded with only 2 ETH via Tornado Cash, controlled four USDC strategy vaults and about 91% of the <a href="https://xpertsstudio.com/bitcoin-ethereum-rally-20-is-the-crypto-bear-market-over/” title=”Bitcoin, Ethereum Rally 20%+ — Is the Crypto Bear Market Over?”>Ethereum Meta Vault, underscoring governance and security risks in audited crypto protocols. Term Labs is investigating and has not confirmed recoverable amounts; this follows a prior $1.5M oracle-related loss in May 2025.
See what traders are focused on
The DeFi protocol Term Labs has suffered an estimated $8.5 million loss after an attacker gained control of its governance system and used it to drain several vaults. The attack did not break the protocol’s code. Instead, the attacker gained enough voting power to approve transfers of funds.
How Term Labs Exploit Happens
Blockchain security firm PeckShieldAlert noted that the attacker first built enough voting power to control four USDC strategy vaults and about 91% of the Ethereum Meta Vault. This gave the wallet enough power to pass its own proposals.
Once approved, the vaults followed those orders and moved their funds to the attacker’s wallet. This means the exploit was mainly a governance attack, rather than a normal smart contract hack.
The attacker reportedly used only 2 ETH from Tornado Cash to fund the wallets used in the attack.
The biggest concern is that the attacker did not need to find a broken line of code. Instead, they gained enough voting power to control the vaults. This shows that even audited DeFi protocols can face risks if their governance system is not well protected.
$8.5M Drained From Term Vaults
Furthermore, PeckShieldAlert reported that the attacker drained around 2,843 ETH, worth about $6.87 million, along with roughly $1.6 million in DAI. Earlier, about $1.68 million in USDC was reportedly swapped for DAI.
Around $8,5M lost due to an exploit on Term Finance
The stolen funds were moved to a wallet now holding most of the reported assets. Term Labs has confirmed that a governance exploit affected its vaults but said its investigation is still ongoing.
What Happens to User Funds Now?
Term Labs has not yet provided a full recovery plan or confirmed how much of the loss can be recovered.
Term Labs officially acknowledged the incident,
“We are aware of a governance exploit impacting Term vaults. We will share more details once it has been further investigated.”
This is also the protocol’s second major loss. In May 2025, Term Finance lost about $1.5 million because of an oracle decimal error during an upgrade, although those funds were later recovered.
Source: cryptorank.io