$8.5M Lost as Term Labs Governance Exploit Drains Vaults

DeFi protocol Term Labs has suffered an estimated $8.5 million loss after an attacker gained control of its governance system and drained several vaults. The attack did not break the protocol's code but rather exploited weaknesses in its governance process.

The attacker used Tornado Cash to fund wallets with only 2 ETH, which was then used to gain enough voting power to control four USDC strategy vaults and about 91% of the Ethereum Meta Vault. This gave the wallet sufficient power to pass proposals that allowed funds to be transferred out.

PeckShieldAlert noted that the attacker's plan was a governance attack rather than a traditional smart contract hack. The fact that audited DeFi protocols can still face risks if their governance system is not well protected raises concerns about the security of these systems.