Term Finance Reports $8.5M Loss After Vault Governance Exploit

Decentralized lending protocol Term Finance has reportedly suffered a major governance-related theft targeting its vault product, with security firms estimating losses of roughly $8.5 million. The incident centers on Term Meta Vaults—strategy vault contracts designed to allocate and manage assets—where an attacker allegedly gained control of governance and used it to drain funds. PeckShield said the attacker extracted about 2,843 ETH and 1.68 million USDC. PeckShield’s post valued the ETH at approximately $6.87 million at the time of the reported drain, and stated that the USDC was converted into about 1.68 million DAI. CertiK reported a broadly similar figure, putting the total loss at around $8.5 million. Key takeaways Security firms estimate Term Finance’s vault theft at about $8.5 million, based on reported withdrawals of ETH and stablecoins. The attack is described as a governance takeover: the attacker allegedly obtained voting power and passed proposals enabling vault control. Term Labs says it has shut down Term Meta Vaults and revoked their DAO governance roles, aiming to stop further deposits while allowing withdrawals. Earlier risk controls were already tightened after a prior 2025 oracle incident, but this new event again highlights governance as a critical attack surface. Estimated losses and what was taken Multiple blockchain security monitors aligned on the scale of the exploit. According to PeckShield’s alert, the attacker drained approximately 2,843 ETH and 1.68 million USDC from Term’s vault system. PeckShield also indicated that the USDC was traded into roughly 1.68 million DAI. CertiK’s estimate matched the order of magnitude, placing the combined loss at about $8.5 million. The reported theft was especially significant relative to what Term had deployed in its vaults: DefiLlama data indicates the Term vault product held about $12.45 million prior to the incident, including nearly all of its roughly $8.8 million in Ethereum deposits. Term Labs freezes vaults, claims core protocol markets were not affected Term Labs responded by stating it had “irreversibly shut down all Term Meta Vaults” and revoked their DAO governance roles. The company said the move prevents additional deposits, while withdrawals remain open. In its statement, Term Labs said its investigation so far indicates the underlying Term protocol, along with its direct borrowing and lending markets, were not affected. The team also emphasized that it was still validating the full scope of impact, including whether any additional exposure exists beyond the vault contracts targeted in the incident. Governance manipulation allegedly enabled vault control Monitoring service Defimon said the attacker likely achieved control by cheaply acquiring a majority of a sparsely distributed governance token. Defimon reported that the attacker then used that control to submit proposals that allowed it to seize control of Term’s vaults.