Term Finance Governance Attack Drains $8.5 Million in Ethereum Assets

Term Finance, an Ethereum-based fixed-rate lending protocol, suffered a governance attack that drained vault-held assets worth $8.5 million. The attacker exploited Term's governance system and withdrew about 2,843 ETH (worth roughly $6.9 million) and 1.68 million USDC from its vaults.

The stolen USDC was later swapped for about 1.68 million DAI. According to blockchain security firms PeckShield and CertiK, the attack did not result from a vulnerability in Yearn Finance, the technology underpinning Term's vaults. Instead, the exploit occurred through Term's custom governance wrapper added to the vaults.

Term's strategy vaults are built on Yearn V3 infrastructure, but this attack method does not apply to standard Yearn vaults. The loss amounts to about 68% of Term Finance vaults' roughly $12.45 million in TVL (total value locked), indicating that most assets deposited on the Ethereum network were drained.