Ethereum DeFi takes another hit – Term Finance governance attack drains $8.5M

Another day and yet another blow to crypto security. On the 23rd of August, Term Finance, a DeFi lending & borrowing protocol on Ethereum [ETH], was attacked.

Rather than directly breaking into the protocol through a smart contract bug, the illicit actor took advantage of the weakness in Term Finance’s DAO governance system.

How did the hacker drain millions in ETH?

A relatively small amount of Term’s governance token was actively available in the market. Using this as an opportunity, the wrongdoer bought a large enough portion of the governance tokens at a low cost to gain majority voting power. 

Soon after the attacker got enough votes for approval, they simply went ahead and submitted and approved malicious governance proposals. This, in turn, gave the attacker control over Term Finance’s vaults, which hold users’ assets.

But before that, the attacker reportedly funded the operation with 2 ETH sourced through Tornado Cash. This caused a drain of approximately $8.5 million from Ethereum. 2,843 ETH, worth $6.87 million, alongside 1.68 million USDC were compromised. The attacker swapped those tokens for roughly 1.68 million DAI.

2026 becomes the worst year for Ethereum

A recent security report from Blockaid uncovered that in H1 2026, crypto theft and fraud losses exceeded $1 billion. Wherein, Ethereum accounted for the largest share of losses, worth approximately $332 million.