Ethereum DeFi lender Term Finance suffers $8.5M DAO governance attack

Term Finance, an Ethereum-based DeFi lending and borrowing protocol, was attacked on Aug. 23 in an incident that exploited weaknesses in its DAO governance process rather than a smart-contract flaw. According to details shared by Term Finance on X, a limited amount of Term's governance token was readily available on the market. The attacker accumulated enough tokens at relatively low cost to obtain majority voting power, then proposed and passed malicious governance actions. Once approved, the measures granted control over Term Finance's vaults holding user assets. The attacker reportedly funded the operation with 2 ETH sourced via Tornado Cash. Roughly $8.5 million was drained, including 2,843 ETH (about $6.87 million) and 1.68 million USDC. The stolen assets were then swapped into about 1.68 million DAI. The breach comes as new data points to worsening losses across the ecosystem. A Blockaid security report said crypto theft and fraud losses topped $1 billion in H1 2026, with Ethereum representing the largest share at about $332 million. Blockaid attributed Ethereum's losses mainly to smart-contract and application-layer exploits, including bridge vulnerabilities, privileged-account abuse, and protocol-logic issues. Recent attacks on Ethereum infrastructure have added to those concerns. AMBCrypto previously reported that the VerusEthereum Bridge was hit for a second time in July, with about $7.54 million drained. A similar incident in May compromised nearly $11.58 million, raising questions about whether earlier fixes fully addressed the underlying weakness. Market pressure has accompanied the security setbacks. Ether, which traded near $4,000 in mid-January, was around $2,412 at the time of writing. CoinGecko data shows ETH is down 48.9% over the past year, amid security incidents, regulatory uncertainty, geopolitical tensions, expectations for Fed rate cuts, and other factors. Summary: Investigators say the attacker accumulated governance tokens cheaply to capture majority voting power and push malicious proposals. Blockaid estimates Ethereum accounted for about $332 million of the more than $1 billion lost to crypto theft and fraud in H1 2026.