Ethereum-based fixed-rate lending platform Term Finance lost an estimated $8.5m after an unknown attacker exploited its governance system and drained ether and stablecoins from its vaults on Sunday.
Blockchain security firms PeckShield and CertiK reported the incident, while Term Labs confirmed that its vaults had been affected but said it was still investigating the attack.
“We are aware of a governance exploit impacting Term vaults,” Term Labs said on X. The team added that it would provide further information once its investigation was complete, but it did not confirm the total loss or specify which vaults were affected.
PeckShield said the attacker withdrew approximately 2,843 ETH, valued at about $6.9m, along with 1.68 million USDC. The USDC was then exchanged for roughly 1.68 million DAI, according to the security firm.
The funds were traced to a single address that had initially received 2 ETH from Tornado Cash, a cryptocurrency mixing protocol. CertiK separately estimated the overall loss at approximately $8.5m.
Term Finance’s Strategy Vaults are ERC-4626 tokenised vaults built using Yearn V3 infrastructure. According to Term’s developer documentation, they distribute capital between Term’s fixed-rate lending markets and variable-rate lending protocols.
Yearn said the incident was linked to a Term-specific governance component rather than the standard Yearn vault architecture.
“While their contracts are built on Yearn’s V3 architecture, the exploit occurred via a custom governance wrapper around the vaults and this attack vector is not applicable to standard Yearn vault setups,” Yearn wrote on X following the incident. “Funds deposited to standard Yearn vaults are safe and those vaults are unaffected.”
Questions over governance safeguards
Term’s vaults use a governance model that divides operational responsibilities from oversight by depositors.
A “manager” is responsible for auction operations, while a “governor” controls risk parameters, protocol configuration and emergency functions. Liquidity providers, known as LPs, participate as members of the decentralised autonomous organisation and can vote against queued governance transactions during a seven-day timelock.
Term’s governance documentation says that a successful LP veto invalidates a transaction before it can be carried out.
Governors are able to change the protocol controller, price oracle and risk limits. They can also pause deposits or strategy activity. Term has not said which governance role was used in the attack, or why the timelock and LP veto process did not stop the transactions from being executed.
Before the incident, the vaults held about $12.45m in total value locked, according to DefiLlama. Around $8.8m of that amount was held on the Ethereum network.
The reported $8.55m loss represents about 68% of the vault product’s total value locked across all chains and almost all of its Ethereum-based holdings.
The vaults are only one part of Term Finance’s wider platform. DefiLlama’s combined protocol data showed that Term had about $25.8m in total value locked before the attack, including $3.79m in active loans.
Term Finance also suffered a separate loss in April 2025 when a misconfigured oracle caused incorrect liquidations in its tETH market. The protocol recovered more than $1m of the $1.6m loss and said its treasury would cover the outstanding amount, The Block previously reported.
At the time, Term said: “This was not a hack. No smart contracts were exploited, and user funds were not directly targeted.”
Governance attacks have affected a number of decentralised finance protocols, sometimes using flash loans or inexpensive governance tokens to influence votes. In March, an attacker spent about $1,800 on tokens to push through a proposal that threatened $1.08m at Moonwell.
Beanstalk lost approximately $182m in a flash-loan governance exploit in 2022, according to reporting by The Block.
The Block said it was unable to immediately reach Term Labs for comment.
The Block is an independent media organisation providing news, research and data. As of November 2023, Foresight Ventures was its majority investor. Foresight Ventures invests in other companies in the cryptocurrency sector, while cryptocurrency exchange Bitget is an anchor limited partner for the firm. The Block said it continues to operate independently and publishes financial disclosures.
© 2026 The Block. All Rights Reserved. The article is provided for information only and is not intended as legal, tax, investment or financial advice.
