Term Finance Loses $8.5M After Attacker Buys Governance Votes for Just 2 ETH

An attacker exploited Term Finance's governance mechanism on August 23, acquiring control of four USDC strategy vaults and approximately 91% of the Ethereum Meta Vault. The attacker spent around 2 ETH ($640) to drain $8.5 million from the platform, funneling the stolen funds into a single wallet.

The attack targeted the voting mechanics rather than any flaw in the underlying smart contract code. Term Labs, the development team behind Term Finance, acknowledged the breach and is currently investigating the incident.

This exploit highlights the issue of cheap or concentrated voting power, which can be misused by attackers to control funds. A similar incident occurred with Beanstalk in 2022 when an attacker used a flash loan to pass a malicious governance proposal, draining $182 million.