Term Labs Suffers $8.5M Governance Exploit Affecting Vaults
Term Labs, the decentralized finance (DeFi) protocol behind fixed-rate lending platform Term Finance, suffered a severe governance exploit on August 23 that drained approximately $8.5 million from its vaults.
Blockchain security firms PeckShieldAlert and CertiK Alert confirmed the losses, noting that the attacker currently holds roughly 2,843 ETH and approximately $1.6 million in DAI at a single address. On-chain records indicate that the attacker’s wallet was initially funded with 2 ETH through the cryptocurrency mixer Tornado Cash.
The root cause of the breach was a critical vulnerability in Term Labs’ governance structure, where voting power was insufficiently protected against economic capture.
According to a technical breakdown published by Go Plus Security, the attacker acquired absolute governance control for merely 0.5 ETH. The exploit began with a swap of approximately 0.5 ETH into 0.485 tmvETH, which was subsequently deposited into the Yearn/Governance wrapper to mint an equivalent amount of gtmvETH—granting immediate and disproportionate voting rights.
The attacker then self-submitted and self-approved proposalId=5 without meaningful opposition. After a six-day waiting period, the proposal was executed, bypassing the Zodiac Delay module’s cooldown and expiration safeguards. This manipulation allowed the attacker to register a malicious strategy, alter debt parameters, and vacuum the vault’s WETH holdings into a pre-deployed contract before routing the stolen funds to their own address.
Protocol Response and Governance Accountability
In a public statement, Term Labs acknowledged the incident, stating: “We are aware of a governance exploit impacting Term vaults. We will share more details once it has further investigated.”
The team clarified that the underlying Term protocol and its direct borrowing and lending markets were not affected by the breach. As an immediate containment measure, all Term Meta Vaults were permanently shut down, DAO governance roles were revoked, and further deposits were irreversibly disabled—though withdrawals remain open for users.
The team is coordinating with external security firms on remediation and recovery, noting that “if a shortfall remains, we will explore paths to address it.”
The incident raises serious questions about Term Labs’ security posture, particularly given a prior oracle failure in April 2025 that triggered unintended liquidations totaling approximately 918 ETH.
Although the protocol recovered 556 ETH and reimbursed affected users—reducing the net loss to 362 ETH—that event prompted public pledges of third-party validation for critical updates and greater governance transparency. The latest exploit, which required minimal capital to execute, suggests those commitments failed to prevent a fundamental governance vulnerability.
Disclaimer
In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, we suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice.
About The Author
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
More articles
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
