Term Finance Loses $8.5M In Ethereum Governance Attack

Term Finance, an Ethereum (ETH)-based DeFi lending protocol, lost about $8.5 million after an attacker exploited its governance system to seize control of vault assets on Aug. 23.

Key Points:

• The attacker drained about $8.5 million, including 2,843 ETH and roughly $1.68 million in stablecoins, according to blockchain security researchers.
• The incident targeted governance controls rather than a conventional smart-contract vulnerability.
• Ethereum led blockchain losses in H1 2026 with about $332 million stolen across tracked incidents, according to Blockaid.

Term Finance Exploit

Term Labs said, “We are aware of a governance exploit impacting Term vaults,” and said it would release more information after investigating the incident. PeckShield estimated that the attacker drained 2,843 ETH, valued at about $6.87 million, and 1.68 million USD Coin (USDC) from the protocol.

PeckShield said the attacker swapped the USDC for roughly 1.68 million Dai (DAI), while the wallet used to launch the operation received 2 ETH through Tornado Cash. The funding trail does not identify the attacker.

Reporting on the exploit indicates the attacker accumulated enough governance power to approve proposals that gave control over affected vaults. The incident relied on governance mechanics rather than a conventional smart-contract vulnerability, making low participation and concentrated voting power central to the attack.