Term Finance Hit by $8.5M Governance Attack, Shuts Down Vaults Permanently

Decentralized lending platform Term Finance has lost roughly $8.5 million after a hacker seized control of its strategy vaults through a governance exploit. Security firms tracking the incident say the attacker drained close to 2,843 ETH, worth about $6.87 million at the time, along with 1.68 million USDC that was swapped into DAI.

Nearly All Vault Funds Wiped Out

The stolen amount made up around 68% of the $12.45 million that was sitting in Term’s vault product before the breach, wiping out almost all of its Ethereum holdings. Reports suggest the attacker managed to buy up a majority share of a thinly held governance token, then pushed through proposals that handed them control of the vaults.

Term Shuts Vaults, Withdrawals Still Open

Term Labs confirmed it has permanently closed all Meta Vaults and cancelled their DAO governance permissions. No new deposits will be accepted, though users can still withdraw funds. The team says its main lending and borrowing markets were not affected, though checks are ongoing. Yearn, whose infrastructure powers the vaults, clarified the exploit relied on a custom governance setup and does not affect its standard vaults.