Ethereum Governance Attack Drains $8.5M from Term Finance

Term Finance, an Ethereum-based DeFi lending protocol, suffered a significant loss of about $8.5 million due to a governance attack on August 23. The attacker exploited the protocol's governance system to seize control of vault assets and drained approximately 2,843 ETH and around $1.68 million in stablecoins.

The incident targeted governance controls rather than a conventional smart-contract vulnerability, making low participation and concentrated voting power central to the attack. PeckShield estimated that the attacker swapped USDC for roughly 1.68 million Dai (DAI) while receiving 2 ETH through Tornado Cash in the funding trail.

Term Labs acknowledged the incident, stating, 'We are aware of a governance exploit impacting Term vaults,' and promised to release more information after investigating. The protocol's history with security incidents includes an operational failure on April 26, 2025, when an oracle decimal inconsistency led to about 918 ETH in unintended liquidations.