Term Finance Reports $8.5M Loss After Vault Governance Exploit

Decentralized lending protocol Term Finance has reportedly suffered a major governance-related theft targeting its vault product, with security firms estimating losses of roughly $8.5 million. The incident centers on Term Meta Vaults—strategy vault contracts designed to allocate and manage assets—where an attacker allegedly gained control of governance and used it to drain funds.

PeckShield said the attacker extracted about 2,843 ETH and 1.68 million USDC. PeckShield’s post valued the ETH at approximately $6.87 million at the time of the reported drain, and stated that the USDC was converted into about 1.68 million DAI. CertiK reported a broadly similar figure, putting the total loss at around $8.5 million.

Key takeaways

• Security firms estimate Term Finance’s vault theft at about $8.5 million, based on reported withdrawals of ETH and stablecoins.
• The attack is described as a governance takeover: the attacker allegedly obtained voting power and passed proposals enabling vault control.
• Term Labs says it has shut down Term Meta Vaults and revoked their DAO governance roles, aiming to stop further deposits while allowing withdrawals.
• Earlier risk controls were already tightened after a prior 2025 oracle incident, but this new event again highlights governance as a critical attack surface.

Estimated losses and what was taken

Multiple blockchain security monitors aligned on the scale of the exploit. According to PeckShield’s alert, the attacker drained approximately 2,843 ETH and 1.68 million USDC from Term’s vault system. PeckShield also indicated that the USDC was traded into roughly 1.68 million DAI.

CertiK’s estimate matched the order of magnitude, placing the combined loss at about $8.5 million. The reported theft was especially significant relative to what Term had deployed in its vaults: DefiLlama data indicates the Term vault product held about $12.45 million prior to the incident, including nearly all of its roughly $8.8 million in Ethereum deposits.

Term Labs freezes vaults, claims core protocol markets were not affected

Term Labs responded by stating it had “irreversibly shut down all Term Meta Vaults” and revoked their DAO governance roles. The company said the move prevents additional deposits, while withdrawals remain open.

In its statement, Term Labs said its investigation so far indicates the underlying Term protocol, along with its direct borrowing and lending markets, were not affected. The team also emphasized that it was still validating the full scope of impact, including whether any additional exposure exists beyond the vault contracts targeted in the incident.

Governance manipulation allegedly enabled vault control

Monitoring service Defimon said the attacker likely achieved control by cheaply acquiring a majority of a sparsely distributed governance token. Defimon reported that the attacker then used that control to submit proposals that allowed it to seize control of Term’s vaults.

Term has not confirmed how the attacker obtained voting power or which exact governance functions were used. That uncertainty matters for users and integrators because it points to gaps that may extend beyond a single contract bug—especially when governance frameworks can be influenced through token concentration, proposal mechanics, or voting wrappers.

Term’s vault contracts are built using Yearn V3 infrastructure. However, Yearn stated that the exploit relied on a custom governance wrapper and that the attack vector does not apply to standard Yearn vault setups. This distinction is important for builders evaluating whether “Yearn-based” automatically implies “protected by default” governance assumptions.

Why this echoes a prior Term incident

This governance exploit comes after an earlier Term incident in April 2025, when an oracle error is reported to have triggered unintended liquidations totaling about 918 ETH. Term’s subsequent response included recovering about 556 ETH at the time, reducing its final loss to 362 ETH, and reimbursing affected users, according to a postmortem published by Term.

In the wake of that April 2025 episode, Term pledged third-party validation for critical updates and committed to greater governance transparency. The new theft suggests that, regardless of improvements to operational controls and monitoring, governance pathways can still become high-impact targets if attackers can acquire voting influence or exploit proposal execution flows.

At this point, the most actionable questions for stakeholders are whether Term’s remaining vaults and governance arrangements are fully isolated from the compromised mechanics, and how quickly Term can quantify any residual exposure. With the company already disabling Meta Vault deposits and revoking governance roles, attention should turn to the scope of affected contracts, the likelihood of partial recovery, and whether Term’s governance design will undergo further structural changes before the next round of vault operations resumes.