$8.5M Drained from Term Finance via Governance Attack

A recent exploit at Term Finance, an Ethereum lending protocol, has drained $8.5 million from its deposit pools. The attacker didn't rely on a security flaw in the code but instead acquired enough voting rights to single-handedly win votes over those pools. They then voted to pay themselves and executed that resolution.

The attack occurred on August 23, 2026, and affected four of five USDC strategy vaults, where the attacker held 100% of the voting rights. In the Ethereum meta vault, they controlled around 91%. The compromised pools were whatever the attacker had a majority over, and those holding balances in other pools weren't affected.

The seed capital for the attack was as little as two ETH obtained via Tornado Cash, which blurs the link between sender and recipient addresses on the blockchain. From this small amount, the attacker built up voting weight step by step until reaching the necessary majorities.