Term Finance Hit for $8.5M After Attacker Spends About 2 ETH to Buy Governance Control

An attacker spent roughly 2 ETH to seize governance influence and extract about $8.5 million from fixed-rate lending protocol Term Finance. On Aug. 23, the exploit allowed the attacker to take over multiple strategy vaults and siphon approximately 2,843 ETH (around $6.87 million) along with 1.68 million USDC. Investigators said the operation was initially funded via Tornado Cash, the sanctioned Ethereum mixer, and the stolen assets were consolidated into a single wallet. According to security firms PeckShield and CertiK, the incident did not hinge on a flaw in the underlying smart contracts. Instead, it targeted the protocol's governance and voting mechanics. The attacker reportedly gained 100% voting control over four of Term Finance's five USDC strategy vaults and about 91% control over the Ethereum Meta Vault. With a supermajority in hand, the attacker could direct vault assets to destinations of their choosing. The affected vaults run on Yearn V3 infrastructure with a custom governance layer built by Term Labs, the team behind Term Finance. After the theft, the USDC proceeds were swapped into DAI, a common laundering step that can complicate tracing and freezing because DAI cannot be blacklisted by a centralized issuer like Circle. The breach marks the protocol's second major incident in just over a year. In May 2025, Term Finance suffered a roughly $1.5 million loss linked to an oracle error during a system upgrade, though those funds were later recovered. Term Labs said it is investigating the latest attack but has not provided details on potential recovery efforts or remediation plans. The exploit is also renewing scrutiny of a recurring DeFi weakness: when voting power is inexpensive or overly concentrated, governance can become an attack surface. The economics highlighted here are stark—spending about 2 ETH to gain control over vaults holding millions implies governance influence was priced far below the value it could command. A comparable governance-driven drain hit Beanstalk in 2022, when an attacker used a flash loan to pass a malicious proposal and extract roughly $182 million. While the mechanics differ, the underlying vulnerability is the same. Common safeguards include timelocked voting, stricter quorum requirements, limits on vote delegation, and multisig overrides for sensitive vault operations—measures designed to raise the cost and reduce the speed of governance takeovers.