$8.5 Million Drained from Term Labs' DeFi Vaults in Governance Exploit

Term Labs' DeFi lending protocol suffered a governance exploit that drained $8.5 million from its vaults. The attack, which is part of a growing list of costly DeFi security incidents in 2026, targeted the stablecoins USDC and DAI, with 2,843 ETH also stolen.

The attacker converted the stablecoins into approximately 1.68 million DAI after draining them from Term Labs' vaults. Blockchain security researchers were able to trace the attack wallet back to an initial 2 ETH transfer from Tornado Cash, but the funding trail does not identify the attacker.

The protocol has $12.26 million in total value locked, with roughly $8.64 million deployed on Ethereum. Governance attacks are less common than private-key compromises or bridge exploits, but they can allow attackers to use a protocol's own control mechanisms against it.