Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
DeFi Security News
Term Finance lost an estimated $8.5 million on Aug. 23 after an attacker exploited the governance system of its strategy vaults, according to blockchain security firms PeckShield and CertiK.
PeckShield reported that approximately 2,843 Ethereum (ETH), worth around $6.87 million at the time, was drained from the vaults, along with 1.68 million USD Coin (USDC) that was converted into an equivalent amount of Dai (DAI). CertiK put the combined total at roughly $8.5 million.
Before the attack, Term’s vaults held $12.45 million The amount removed represented about 68% of that total, including nearly all of the vaults’ $8.8 million in ETH deposits
How the Attacker Gained Control
On-chain monitoring service Defimon reported the attacker acquired a majority of a sparsely held governance token at low cost, then used that position to pass proposals giving it control over the vault contracts. Term Labs has not confirmed which governance functions were used or the exact method by which voting control was obtained.
The vaults were built on Yearn V3 infrastructure. Yearn stated the exploit involved a custom governance wrapper specific to Term Finance and that standard Yearn vault setups are not exposed to the same attack vector.
Related Article: Harmony Confirms Exploit After Attacker Mints 4B ONE Token
Term Closes Vaults and Begins Recovery Effort
Term Labs said it permanently shut down all Term Meta Vaults following the incident and revoked their decentralized autonomous organization governance roles. Withdrawals remain open, but the protocol is no longer accepting new deposits into those products. Term said its core borrowing and lending markets were unaffected, though it was still assessing the full scope of the attack at the time of the statement.
The company said it is working with external security teams on asset recovery and will look into options for addressing any remaining shortfall. Cointelegraph was unable to reach Term Labs for comment.
This was not the first security incident Term has faced. In April 2025, an oracle error caused approximately 918 ETH in unintended liquidations. Term recovered 556 ETH, absorbed a final loss of 362 ETH, and reimbursed affected users. After that event, the protocol committed to third-party validation for critical updates and increased governance transparency.
This article contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author’s [company’s] own and do not necessarily reflect those of CoinMarketCap.
Source: coinmarketcap.com