Term Finance loses $8.5 million in governance exploit
This digest was compiled by AI from multiple sources — links to the originals are below.
Ethereum-based lending protocol Term Finance lost about $8.5 million on Sunday after an attacker exploited its governance system to drain vaults. Blockchain security firms PeckShield and CertiK estimated the loss, with funds traced to an address initially funded by Tornado Cash. Term Labs acknowledged the exploit on X and said it is investigating.
Key Facts
- PeckShield estimated the attacker withdrew about 2,843 ETH worth roughly $6.9 million and 1.68 million USDC, later swapped for about 1.68 million DAI.
- CertiK put the total loss at roughly $8.5 million.
- The reported loss equals about 68% of Term's vault TVL across all chains, which stood at $12.45 million before the hack.
- Term Finance previously suffered a loss in April 2025 after a misconfigured oracle led to faulty liquidations in its tETH market.
Governance Exploit
Term's Strategy Vaults are ERC-4626 tokenized vaults built on Yearn V3 infrastructure, allocating capital between fixed-rate and variable-rate lending protocols. The exploit occurred via a custom governance wrapper around the vaults, an attack vector not applicable to standard Yearn vault setups, according to Yearn. Term's governance structure separates operational control from depositor oversight, with a manager role handling auction operations and a governor role overseeing risk parameters and emergency functions. Vault liquidity providers can vote to veto queued governance transactions during a seven-day timelock, but Term has not disclosed which role the attacker used or why the veto did not prevent the exploit.
Fund Tracing
PeckShield traced the drained funds to a single address that had initially received 2 ETH from mixing protocol Tornado Cash. The attacker withdrew about 2,843 ETH and 1.68 million USDC, then swapped the USDC for about 1.68 million DAI. Term Labs said on X that it is aware of the governance exploit impacting Term vaults and will provide more detail after investigating.
Protocol Impact
Prior to the hack, Term's vault TVL was about $12.45 million, including $8.8 million on Ethereum, according to DefiLlama. The $8.55 million loss represents nearly all of the vaults' Ethereum TVL and more than two-thirds of total vault TVL across chains. Term overall had about $25.8 million in total value locked and $3.79 million in active loans before the hack.
2 sources
Term Finance loses $8.5 million in governance exploit
