$8.5M Stolen from Term Finance via Governance Hijack
Term Finance, an Ethereum fixed-rate lending protocol, suffered an $8.5 million loss on August 23 after an attacker hijacked its governance vote and approved withdrawals from several vaults.
The attacker gained control of four out of five USDC strategy vaults and about 91% control of the Ethereum Meta Vault, allowing them to drain approximately 2,843 ETH (worth $6.87 million at the time) and 1.68 million USDC, which was swapped into DAI.
According to PeckShield, the attacker initially funded their wallet with just 2 ETH from Tornado Cash, a service that has been at the center of sanctions fights in the United States.
The incident highlights the vulnerability of DeFi protocols running on-chain governance, where attackers can accumulate voting power and manipulate fund movements without breaking any smart contract code.
Term Labs acknowledged the issue but has not published a full post-mortem or recovery plan. The incident serves as a warning that governance mechanisms, rather than just smart contracts, need to be secured to prevent such attacks.