Term Labs hit for $8.5M after governance takeover drains strategy vaults

Term Finance, an Ethereum-based fixed-rate lending protocol developed by Term Labs, said it suffered an estimated $8.5 million loss after an attacker amassed enough voting power to take control of its strategy vaults. Blockchain security firms CertiK and PeckShield attributed the incident to a governance manipulation attack, not a smart-contract bug. They estimate the attacker siphoned roughly 2,843 ETH and about 1.6 million DAI, consolidating the funds into a single wallet address. The incident occurred on Aug. 23. Investigators said the attacker secured 100% voting control over four of the protocol's five USDC strategy vaults and roughly 91% control of the Ethereum Meta Vault. With that supermajority, the attacker approved actions that redirected assets to an address beginning with 0xD5183. The attacker's initial capital reportedly traced back to just 2 ETH routed through Tornado Cash. From that small starting point, the attacker built sufficient governance influence to effectively commandeer vaults holding millions in user deposits. Term Labs acknowledged the governance issue and said it is investigating. The team emphasized the incident was not caused by a vulnerability in the underlying smart contracts. The protocol has faced losses before. In May 2025, Term Finance lost about $1.5 million due to an oracle decimal mismatch introduced during a routine upgrade. That event was described as non-malicious, and the funds were later returned. Term Labs raised $2.5 million in seed funding in early 2023, led by founder and CEO Dion Chu. The project's pitch has been to bring TradFi-style fixed-rate structures to on-chain lending via overcollateralized, fixed-income-like products. The episode highlights a recurring DeFi risk: governance attacks that exploit voting mechanics rather than software flaws. In this case, audited contracts were used as intended, while inadequate guardrails around voting power and vault management enabled a hostile takeover. For affected depositors, recovery remains uncertain, particularly given the attacker's use of Tornado Cash to obscure on-chain attribution.