Term Finance Loses $8.5 Million in Governance Exploit

Term Finance has permanently closed its Meta Vaults after an attacker exploited the protocol's governance system to drain approximately $8.5 million in assets [1]. The breach, which removed nearly all of the $8.8 million in Ethereum deposits held in the vaults, represents a significant loss of 68% of the product's $12.45 million total value [1].

How the governance exploit occurred

The attack appears to have bypassed standard smart contract security by targeting the protocol’s governance layer rather than the code itself [2]. According to on-chain monitoring service Defimon, the attacker cheaply accumulated a majority of Term Finance’s thinly distributed governance tokens, granting them sufficient voting power to pass malicious proposals [1]. These proposals allowed the attacker to seize control of the vaults and authorize the unauthorized withdrawals [2].

While the Meta Vaults utilized Yearn V3 infrastructure, Yearn clarified that the vulnerability was specific to a custom governance wrapper implemented by Term Finance and does not affect standard Yearn vault configurations [1]. Term Labs has since revoked the DAO governance roles associated with the vaults to prevent further unauthorized actions [1]. The company stated that its core borrowing and lending markets remain unaffected, though it is still verifying the full scope of the incident [1].

Recovery and historical context

Term Finance is currently coordinating with external security teams to attempt asset recovery and is exploring options to address the remaining shortfall for affected users [1]. This incident marks the second major security challenge for the protocol in recent history, following an April 2025 oracle error that triggered 918 ETH in unintended liquidations [2]. In that previous instance, the protocol successfully recovered 556 ETH and reimbursed the affected users, subsequently pledging to implement third-party validation for critical updates [1].

What to watch

• Asset Recovery Efforts: Monitor updates from Term Labs regarding the success of their coordination with security firms to retrieve the 2,843 ETH and 1.68 million USDC [1].
• Remediation Plan: Watch for official announcements on how the protocol intends to address the $8.5 million shortfall and whether it will follow the reimbursement model used after the April 2025 oracle incident [1].
• Governance Transparency: Observe whether the protocol introduces new security measures or changes to its governance tokenomics to prevent future "cheap" majority-voting attacks [2].

The incident underscores the persistent risk in decentralized finance where the cost of acquiring governance control can fall below the value of the assets that control grants access to [2]. Whether Term Finance can restore user confidence depends on its ability to recover the stolen funds and provide a transparent path for remediation.